CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Craft CMS Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2025-32432)
[Affected Scope] Craft CMS versions 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17
[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server via crafted HTTP requests, leading to complete system compromise.
[Mitigation] Immediately upgrade your Craft CMS installation to the patched versions (3.9.15, 4.14.15, or 5.6.17) depending on your major version branch.
Craft CMS Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2024-56145, CISA KEV Listed)
[Affected Scope] Craft CMS versions 3.x, 4.x, and 5.x running on environments where 'register_argc_argv' is enabled in php.ini
[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and gain full system control by sending specially crafted HTTP requests
[Mitigation] Immediately upgrade Craft CMS to patched versions (3.9.14, 4.13.2, or 5.5.2 or higher) and disable 'register_argc_argv' in php.ini
Craft CMS Remote Code Execution (RCE) Vulnerability Security Advisory (CVE-2023-41892)
[Affected Scope] Craft CMS installations running versions prior to 4.4.15
[Impact] Unauthenticated remote attackers can execute arbitrary PHP code and fully compromise the underlying server by sending crafted HTTP requests
[Mitigation] Immediately upgrade Craft CMS to version 4.4.15 or later to resolve the vulnerability