Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

cms — Vulnerabilities & Security Advisories 257

All 257 CVE vulnerabilities found in cms, with AI-generated Chinese analysis, references, and POCs.

This page aggregates Common Weakness Enumerations (CWE) associated with Content Management System (CMS) software. It serves as a centralized resource for security professionals to analyze vulnerability trends across various CMS platforms. The collection includes a comprehensive range of vulnerability types, such as cross-site scripting, SQL injection, arbitrary file upload, and privilege escalation flaws. The data covers security issues reported from January 1, 2020, through the present date. This time range allows for the observation of emerging attack vectors and the evolution of security posture in widely used web content platforms. Visitors to this page can effectively track vendor security advisories and correlate them with specific weakness classes. By examining the aggregated data, users can understand how particular CWE categories impact different CMS architectures, such as WordPress, Drupal, or Joomla. Additionally, the repository enables the lookup of a specific product’s vulnerability history, providing insights into its long-term security maintenance and patch response times. This holistic view aids in risk assessment and helps organizations prioritize remediation efforts based on historical precedent and current threat landscapes. The information is strictly factual, designed to support technical analysis without promotional language or subjective commentary.

Vendor: Mambo

CVE IDTitleCVSSSeverityPublished
CVE-2026-16219 Croogo CMS Admin File Manager FileManager.php isEditable path traversal CWE-22 6.3 Medium2026-07-19
CVE-2026-16205 Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting CWE-79 2.4 Low2026-07-19
CVE-2026-54243 Statamic: CSV formula injection in form submission exports CWE-1236 6.1 Medium2026-07-17
CVE-2026-54242 Statamic: Server-Side Request Forgery via Glide (DNS rebinding) CWE-367 4.9 Medium2026-07-17
CVE-2026-54244 Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors CWE-863 3.5 Low2026-07-17
CVE-2026-12257 Remote code execution in Mura Software’s CMS CWE-94--2026-07-13
CVE-2026-14794 Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization CWE-285 4.3 Medium2026-07-06
CVE-2026-14793 Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization CWE-639 4.3 Medium2026-07-06
CVE-2026-50282 Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves CWE-862--2026-07-02
CVE-2026-50281 Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements CWE-915--2026-07-02
CVE-2026-50280 Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check CWE-284--2026-07-01
CVE-2026-50279 Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap CWE-285--2026-07-01
CVE-2026-55794 Craft CMS: Potential authenticated Remote Code Execution via referrer redirect CWE-1336--2026-07-01
CVE-2026-55792 Craft CMS: Sensitive File Disclosure / Server-Side File Read CWE-200--2026-07-01
CVE-2026-55791 Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs CWE-918--2026-07-01
CVE-2026-55790 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget CWE-79--2026-07-01
CVE-2026-50284 Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets CWE-862--2026-07-01
CVE-2026-50283 Craft CMS: Unauthorized Deletion of Source Assets During File Replacement CWE-862--2026-07-01
CVE-2026-55793 Craft CMS: Stored XSS via Structure entry title in table view CWE-79--2026-07-01
CVE-2026-13546 Feehi CMS REST API Endpoint articles missing authentication CWE-306 7.3 High2026-06-29
CVE-2026-13544 Feehi CMS API users access control CWE-284 6.3 Medium2026-06-29
CVE-2026-56393 Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options CWE-79 4.8 Medium2026-06-21
CVE-2026-56394 Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter CWE-22 6.5 Medium2026-06-21
CVE-2026-56385 Craft CMS - Authorization Bypass in assets/preview-file Endpoint CWE-639 4.3 Medium2026-06-21
CVE-2026-56384 Craft CMS - Missing Authorization in assets/preview-thumb Endpoint CWE-862 4.3 Medium2026-06-21
CVE-2026-56383 Craft CMS - Stored XSS in Table Field via Row Heading Column Type CWE-79 4.8 Medium2026-06-21
CVE-2026-56382 Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController CWE-94 7.2 High2026-06-21
CVE-2026-56381 Craft CMS - Stored XSS via User Group Name in User Permissions Page CWE-79 4.8 Medium2026-06-21
CVE-2026-49288 Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources CWE-200 4.3 Medium2026-06-19
CVE-2026-49287 Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction CWE-470 7.4 High2026-06-19

All 257 known CVE vulnerabilities affecting cms with full Chinese analysis, references, and POCs where available.