Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

CMS — Vulnerabilities & Security Advisories 321

All 321 CVE vulnerabilities found in CMS, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting Content Management Systems. It collects recorded flaws across multiple CMS vendors, spanning advisories published over the last five years. Readers can track vendor-specific security updates, analyze common weakness classes such as SQL injection and cross-site scripting, and review the historical vulnerability trends for any given product. The data is organized by vendor and weakness type, enabling detailed comparison and trend analysis. No specific CVE identifiers are listed in this overview; the focus remains on patterns, frequencies, and remediation guidance. This resource supports security teams, developers, and IT managers who need to prioritize patches and assess risk exposure across their managed platforms.

Vendor: Mambo

CVE ID Title CVSS Severity Published
CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check CWE-287 8.1 High 2026-08-06
CVE-2026-64664 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence CWE-200 4.3 Medium 2026-08-06
CVE-2026-5134 SQLi in Loca Software's CMS CWE-89 9.8 Critical 2026-08-06
CVE-2026-71293 Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable CWE-200 6.2 Medium 2026-08-05
CVE-2026-16219 Croogo CMS Admin File Manager FileManager.php isEditable path traversal CWE-22 6.3 Medium 2026-07-19
CVE-2026-16205 Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting CWE-79 2.4 Low 2026-07-19
CVE-2026-54243 Statamic: CSV formula injection in form submission exports CWE-1236 6.1 Medium 2026-07-17
CVE-2026-54242 Statamic: Server-Side Request Forgery via Glide (DNS rebinding) CWE-367 4.9 Medium 2026-07-17
CVE-2026-54244 Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors CWE-863 3.5 Low 2026-07-17
CVE-2026-12257 Remote code execution in Mura Software’s CMS CWE-94 - - 2026-07-13
CVE-2026-14794 Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization CWE-285 4.3 Medium 2026-07-06
CVE-2026-14793 Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization CWE-639 4.3 Medium 2026-07-06
CVE-2026-50282 Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves CWE-862 - - 2026-07-02
CVE-2026-50281 Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements CWE-915 - - 2026-07-02
CVE-2026-50280 Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check CWE-284 - - 2026-07-01
CVE-2026-50279 Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap CWE-285 - - 2026-07-01
CVE-2026-55794 Craft CMS: Potential authenticated Remote Code Execution via referrer redirect CWE-1336 - - 2026-07-01
CVE-2026-55792 Craft CMS: Sensitive File Disclosure / Server-Side File Read CWE-200 - - 2026-07-01
CVE-2026-55791 Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs CWE-918 - - 2026-07-01
CVE-2026-55790 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget CWE-79 - - 2026-07-01
CVE-2026-50284 Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets CWE-862 - - 2026-07-01
CVE-2026-50283 Craft CMS: Unauthorized Deletion of Source Assets During File Replacement CWE-862 - - 2026-07-01
CVE-2026-55793 Craft CMS: Stored XSS via Structure entry title in table view CWE-79 - - 2026-07-01
CVE-2026-13546 Feehi CMS REST API Endpoint articles missing authentication CWE-306 7.3 High 2026-06-29
CVE-2026-13544 Feehi CMS API users access control CWE-284 6.3 Medium 2026-06-29
CVE-2026-56394 Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter CWE-22 6.5 Medium 2026-06-21
CVE-2026-56393 Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options CWE-79 4.8 Medium 2026-06-21
CVE-2026-56385 Craft CMS - Authorization Bypass in assets/preview-file Endpoint CWE-639 4.3 Medium 2026-06-21
CVE-2026-56383 Craft CMS - Stored XSS in Table Field via Row Heading Column Type CWE-79 4.8 Medium 2026-06-21
CVE-2026-56384 Craft CMS - Missing Authorization in assets/preview-thumb Endpoint CWE-862 4.3 Medium 2026-06-21

All 321 known CVE vulnerabilities affecting CMS with full Chinese analysis, references, and POCs where available.