Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

CMS — Vulnerabilities & Security Advisories 321

All 321 CVE vulnerabilities found in CMS, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting Content Management Systems. It collects recorded flaws across multiple CMS vendors, spanning advisories published over the last five years. Readers can track vendor-specific security updates, analyze common weakness classes such as SQL injection and cross-site scripting, and review the historical vulnerability trends for any given product. The data is organized by vendor and weakness type, enabling detailed comparison and trend analysis. No specific CVE identifiers are listed in this overview; the focus remains on patterns, frequencies, and remediation guidance. This resource supports security teams, developers, and IT managers who need to prioritize patches and assess risk exposure across their managed platforms.

Vendor: Mambo

CVE ID Title CVSS Severity Published
CVE-2026-33883 Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag CWE-79 6.1 Medium 2026-03-27
CVE-2026-33882 Statamic's Markdown preview endpoint exposes sensitive user data CWE-20 6.5 Medium 2026-03-27
CVE-2026-33162 Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions CWE-285 4.3 - 2026-03-24
CVE-2026-33161 Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users CWE-200 5.4 - 2026-03-24
CVE-2026-33160 Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL CWE-639 5.3 - 2026-03-24
CVE-2026-33159 Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users CWE-306 8.6 - 2026-03-24
CVE-2026-33158 Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) CWE-639 4.3 - 2026-03-24
CVE-2026-33157 Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior CWE-470 8.8 - 2026-03-24
CVE-2026-33177 Statamic is missing authorization check on taxonomy term creation via fieldtype CWE-862 4.3 Medium 2026-03-20
CVE-2026-33172 Statamic has Stored XSS via SVG Sanitization Bypass CWE-79 8.7 High 2026-03-20
CVE-2026-33171 Statamic has a path traversal in file dictionary fieldtype CWE-22 4.3 Medium 2026-03-20
CVE-2026-33051 Craft CMS Vulnerable to Stored XSS in Revision Context Menu CWE-79 5.4 - 2026-03-20
CVE-2026-32267 Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() CWE-863 8.8AI High AI 2026-03-16
CVE-2026-32264 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController CWE-470 7.2AI High AI 2026-03-16
CVE-2026-32263 Craft CMS vulnerable to behavior injection RCE via EntryTypesController CWE-470 9.1AI Critical AI 2026-03-16
CVE-2026-32262 Craft CMS has a Path Traversal Vulnerability in AssetsController CWE-22 8.1AI High AI 2026-03-16
CVE-2026-32612 Statamic: privilege escalation via stored cross-site scripting CWE-79 5.4 Medium 2026-03-12
CVE-2026-31859 Craft has Reflective XSS via incomplete return URL sanitization CWE-79 6.1AI Medium AI 2026-03-11
CVE-2026-31858 CraftCMS's `ElementSearchController` Affected by Blind SQL Injection CWE-89 6.5AI Medium AI 2026-03-11
CVE-2026-31857 CraftCMS has an RCE vulnerability via relational conditionals in the control panel CWE-94 8.8AI High AI 2026-03-11
CVE-2026-29113 Craft has a potential information disclosure vulnerability in preview tokens CWE-352 2.3 Low 2026-03-10
CVE-2026-3743 YiFang CMS D_singlePageGroup.php update cross site scripting CWE-79 3.5 Low 2026-03-08
CVE-2026-3742 YiFang CMS D_singlePage.php update cross site scripting CWE-79 3.5 Low 2026-03-08
CVE-2026-3741 YiFang CMS D_friendLink.php update cross site scripting CWE-79 3.5 Low 2026-03-08
CVE-2026-29069 Craft has an unauthenticated activation email trigger with potential user enumeration CWE-639 8.1AI High AI 2026-03-04
CVE-2026-28784 Craft is affected by potential authenticated Remote Code Execution via Twig SSTI CWE-1336 7.2AI High AI 2026-03-04
CVE-2026-28783 Craft has a Twig Function Blocklist Bypass CWE-94 7.2AI High AI 2026-03-04
CVE-2026-28782 Craft has a Permission Bypass and IDOR in Duplicate Entry Action CWE-639 6.5AI Medium AI 2026-03-04
CVE-2026-28781 Craft Affected by Entries Authorship Spoofing via Mass Assignment CWE-639 8.1AI High AI 2026-03-04
CVE-2026-28697 Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates CWE-1336 7.2AI High AI 2026-03-04

All 321 known CVE vulnerabilities affecting CMS with full Chinese analysis, references, and POCs where available.