netVigilance Vulnerability intelligence since 2004

Craft CMS

4 Craft CMS vulnerabilities with confirmed exploitation in the wild, as published by CISA; 4 past the federal remediation deadline. This is a static slice of the catalog — open the full catalog for search and filters.

Known exploited vulnerabilities for Craft CMS
Vulnerability Status
overdue 160d2026-04-03 CVE-2025-32432 Craft CMS / Craft CMS Craft CMS Code Injection Vulnerability 2026-03-20 10.0 past due
overdue 444d2025-06-23 CVE-2025-35939 Craft CMS / Craft CMS Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability 2025-06-02 6.9 past due
overdue 444d2025-06-23 CVE-2024-56145 Craft CMS / Craft CMS Craft CMS Code Injection Vulnerability 2025-06-02 9.3 past due
overdue 546d2025-03-13 CVE-2025-23209 Craft CMS / Craft CMS Craft CMS Code Injection Vulnerability 2025-02-20 8.1 past due
4 records Open in catalog with filters →