Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

CMS — Vulnerabilities & Security Advisories 321

All 321 CVE vulnerabilities found in CMS, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting Content Management Systems. It collects recorded flaws across multiple CMS vendors, spanning advisories published over the last five years. Readers can track vendor-specific security updates, analyze common weakness classes such as SQL injection and cross-site scripting, and review the historical vulnerability trends for any given product. The data is organized by vendor and weakness type, enabling detailed comparison and trend analysis. No specific CVE identifiers are listed in this overview; the focus remains on patterns, frequencies, and remediation guidance. This resource supports security teams, developers, and IT managers who need to prioritize patches and assess risk exposure across their managed platforms.

Vendor: Mambo

CVE ID Title CVSS Severity Published
CVE-2026-56382 Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController CWE-94 7.2 High 2026-06-21
CVE-2026-56381 Craft CMS - Stored XSS via User Group Name in User Permissions Page CWE-79 4.8 Medium 2026-06-21
CVE-2026-49288 Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources CWE-200 4.3 Medium 2026-06-19
CVE-2026-49287 Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction CWE-470 7.4 High 2026-06-19
CVE-2026-11511 Bolt CMS HTML Attribute TextType.php HTML injection CWE-80 3.5 Low 2026-06-08
CVE-2026-45660 Statamic: Server-Side Request Forgery via Glide CWE-918 5.4 Medium 2026-05-29
CVE-2026-44306 Statamic: Email enumeration via forgot password endpoint CWE-204 5.3 Medium 2026-05-12
CVE-2026-44011 Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior CWE-479 - - 2026-05-12
CVE-2026-44012 Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure CWE-862 - - 2026-05-12
CVE-2026-44010 Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure CWE-862 - - 2026-05-12
CVE-2026-7508 Bootstrap CMS Page Creation show.blade.php code injection CWE-94 6.3 Medium 2026-04-30
CVE-2026-7317 Grav CMS Cache Value FileCache.php doGet deserialization CWE-502 5.0 Medium 2026-04-28
CVE-2026-7016 MaxSite CMS ushki Plugin cross site scripting CWE-79 2.4 Low 2026-04-26
CVE-2026-7015 MaxSite CMS Guestbook Plugin cross site scripting CWE-79 2.4 Low 2026-04-26
CVE-2026-7014 MaxSite CMS down_count Plugin cross site scripting CWE-79 2.4 Low 2026-04-26
CVE-2026-7013 MaxSite CMS mail_send Plugin cross site scripting CWE-79 2.4 Low 2026-04-26
CVE-2026-7012 MaxSite CMS Redirect Plugin cross site scripting CWE-79 2.4 Low 2026-04-26
CVE-2026-7011 MaxSite CMS Antispam Plugin plugin_antispam cross site scripting CWE-79 2.4 Low 2026-04-26
CVE-2026-41175 Statamic: Unsafe method invocation via query value resolution allows data destruction CWE-470 8.1 High 2026-04-22
CVE-2026-41130 Craft CMS has a host header injection leading to SSRF via resource-js endpoint CWE-918 10.0AI Critical AI 2026-04-21
CVE-2026-41129 Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations CWE-918 8.3AI High AI 2026-04-21
CVE-2026-41128 Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action CWE-862 4.3AI Medium AI 2026-04-21
CVE-2026-6652 Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection CWE-95 4.7 Medium 2026-04-20
CVE-2026-6649 Qibo CMS headers server-side request forgery CWE-918 6.3 Medium 2026-04-20
CVE-2026-6648 Qibo CMS Internal Message cross site scripting CWE-79 3.5 Low 2026-04-20
CVE-2026-6633 Yifang CMS Extended Management L_rbac_admin.php store cross site scripting CWE-79 3.5 Low 2026-04-20
CVE-2026-33887 Statamic allows unauthorized content access through missing authorization in its revision controllers CWE-862 5.4 Medium 2026-03-27
CVE-2026-33886 Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields CWE-200 6.5 Medium 2026-03-27
CVE-2026-33885 Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential CWE-601 6.1 Medium 2026-03-27
CVE-2026-33884 Statamic's live preview token bypasses content protection for unrelated entries CWE-863 4.3 Medium 2026-03-27

All 321 known CVE vulnerabilities affecting CMS with full Chinese analysis, references, and POCs where available.