craftercms crafter cms

Name: craftercms crafter cms
Brand: craftercms

productUS

cpe:2.3:a:craftercms:crafter_cms:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

2critical12high7medium0low

updated 2026-10-28

vulnerabilities (21)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2022-40635US	high7.2	1.62% (76th)	Exploit	3.1.23	2022-09-13	3.1.0 → 3.1.23
CVE-2022-40634US	high7.2	1.59% (75th)	Exploit	3.1.23	2022-09-13	3.1.0 → 3.1.23
CVE-2017-15684US	high7.5	2.04% (81st)	—	3.0.1	2020-11-27	3.0.0 → 3.0.1
CVE-2017-15681US	critical9.8	2.03% (81st)	—	3.0.1	2020-11-27	3.0.0 → 3.0.1
CVE-2021-23263US	high7.5	1.70% (77th)	—	3.1.15	2021-12-02	3.1.0 → 3.1.15
CVE-2018-19907US	high8.8	1.69% (77th)	—	no fix	2018-12-06	≤ 3.0.18
CVE-2017-15685US	high8.6	1.69% (77th)	—	3.0.1	2020-11-27	3.0.0 → 3.0.1
CVE-2017-15683US	high8.6	1.55% (75th)	—	3.0.1	2020-11-27	3.0.0 → 3.0.1
CVE-2021-23264US	critical9.1	1.18% (67th)	—	3.1.15	2021-12-02	3.1.0 → 3.1.15
CVE-2017-15686US	medium6.1	1.05% (64th)	—	3.0.1	2020-11-27	3.0.0 → 3.0.1
CVE-2021-23267US	high8.8	0.93% (60th)	—	3.1.18	2022-05-16	3.1 → 3.1.18
CVE-2017-15682US	medium6.1	0.75% (55th)	—	3.0.1	2020-11-27	3.0.0 → 3.0.1
CVE-2017-15680US	medium6.5OT elevated	0.75% (55th)	—	3.0.1	2020-11-27	3.0 → 3.0.1
CVE-2021-23259US	high7.2	0.73% (54th)	—	3.1.12	2021-12-02	3.1.0 → 3.1.12
CVE-2021-23258US	high7.2	0.73% (54th)	—	3.1.12	2021-12-02	3.1.0 → 3.1.12
CVE-2021-23261US	medium4.9	0.66% (51st)	—	3.1.13	2021-12-02	3.1.0 → 3.1.13
CVE-2021-23262US	high7.2	0.64% (51st)	—	3.1.13	2021-12-02	3.1.0 → 3.1.13
CVE-2021-23265US	medium4.3	0.60% (49th)	—	3.1.18	2022-05-16	3.1 → 3.1.18
CVE-2021-23266US	medium4.3	0.56% (47th)	—	3.1.18	2022-05-16	3.1 → 3.1.18
CVE-2021-23260US	medium5.4	0.44% (38th)	—	3.1.12	2021-12-02	3.1.0 → 3.1.12
CVE-2023-26020US	high7.2	0.44% (38th)	—	no fix	2023-02-17	2 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-913Improper Control of Dynamically-Managed Code Resources6 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')3 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-402Transmission of Private Resources into a New Sphere ('Resource Leak')2 CVEs
CWE-668Exposure of Resource to Wrong Sphere2 CVEs
CWE-91XML Injection (aka Blind XPath Injection)2 CVEs
CWE-116Improper Encoding or Escaping of Output1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE21 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan