security@craftersoftware.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS security@craftersoftware.com
03
assessed vulnerabilities (19)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-1770US | — | — | ||
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypa… | ||||
| CVE-2025-6384US | critical9.1 | Exploit | ||
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypas… | ||||
| CVE-2025-0502US | critical9.1 | — | ||
Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resou… | ||||
| CVE-2023-4136US | medium6.1 | — | ||
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected… | ||||
| CVE-2023-26020US | high7.2 | — | ||
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection… | ||||
| CVE-2022-40635US | high7.2 | Exploit | ||
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypa… | ||||
| CVE-2022-40634US | high7.2 | Exploit | ||
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI. | ||||
| CVE-2021-23267US | high8.8 | — | ||
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static m… | ||||
| CVE-2021-23266US | medium4.3 | — | ||
An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator. | ||||
| CVE-2021-23265US | medium4.3 | — | ||
A logged-in and authenticated user with a Reviewer Role may lock a content item. | ||||
| CVE-2021-23264US | critical9.1 | — | ||
Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes. | ||||
| CVE-2021-23263US | high7.5 | — | ||
Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). | ||||
| CVE-2021-23262US | high7.2 | — | ||
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE. | ||||
| CVE-2021-23261US | medium4.9 | — | ||
Authenticated administrators may override the system configuration file and cause a denial of service. | ||||
| CVE-2021-23260US | medium5.4 | — | ||
Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site. | ||||
| CVE-2021-23259US | high7.2 | — | ||
Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have securi… | ||||
| CVE-2021-23258US | high7.2 | — | ||
Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which wil… | ||||
| CVE-2020-25803US | high7.2 | — | ||
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template… | ||||
| CVE-2020-25802US | high7.2 | — | ||
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. T… | ||||