# Craftcms Craft Cms


- [CVE-2025-32432](https://insights.sbomify.com/CVE-2025-32432/): Craft CMS Code Injection (critical 10.0, exploited in the wild)
- [CVE-2024-56145](https://insights.sbomify.com/CVE-2024-56145/): Craft CMS Code Injection (critical 9.3, exploited in the wild)
- [CVE-2025-23209](https://insights.sbomify.com/CVE-2025-23209/): Craft CMS Code Injection (high 8.1, exploited in the wild)
- [CVE-2025-35939](https://insights.sbomify.com/CVE-2025-35939/): Craft CMS External Control of Assumed-Immutable Web Parameter (medium 6.9, exploited in the wild)
- [CVE-2023-41892](https://insights.sbomify.com/CVE-2023-41892/): Craft CMS Remote Code Execution vulnerability (critical 10.0)
- [CVE-2021-27903](https://insights.sbomify.com/CVE-2021-27903/): Craft CMS Remote Code Injection (critical 9.8)
- [CVE-2020-9757](https://insights.sbomify.com/CVE-2020-9757/): SEOmatic for CraftCMS allows Server-Side Template Injection (critical 9.8)
- [CVE-2019-15929](https://insights.sbomify.com/CVE-2019-15929/): Craft CMS possibility of brute force attempts (critical 9.8)
- [CVE-2026-28697](https://insights.sbomify.com/CVE-2026-28697/): Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates (critical 9.4)
- [CVE-2026-28783](https://insights.sbomify.com/CVE-2026-28783/): Craft has a Twig Function Blocklist Bypass (critical 9.4)
- [CVE-2023-30130](https://insights.sbomify.com/CVE-2023-30130/): CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter (high 8.8)
- [CVE-2022-29933](https://insights.sbomify.com/CVE-2022-29933/): Improper account password reset in Craft CMS (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/craftcms/craft-cms/