https://vulnogram.org/ Most recent CVEs assigned by crafter (crafter). https://vulnogram.org/seaview/icons/crafter.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-1770 https://vulnogram.org/CVE-2026-1770 Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass san… Medium Mon, 02 Feb 2026 16:16:01 GMT https://vulnogram.org/CVE-2025-6384 https://vulnogram.org/CVE-2025-6384 Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sand… High Thu, 19 Jun 2025 20:57:04 GMT https://vulnogram.org/CVE-2025-0502 https://vulnogram.org/CVE-2025-0502 Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects CrafterCMS: from 4.0.0 before 4.0… Medium Network Exploitable Wed, 15 Jan 2025 17:47:51 GMT https://vulnogram.org/CVE-2023-4136 https://vulnogram.org/CVE-2023-4136 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.… High Network Exploitable Thu, 03 Aug 2023 13:33:10 GMT https://vulnogram.org/CVE-2023-26020 https://vulnogram.org/CVE-2023-26020 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1… Medium Fri, 17 Feb 2023 17:24:45 GMT https://vulnogram.org/CVE-2022-40635 https://vulnogram.org/CVE-2022-40635 Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. Medium Tue, 13 Sep 2022 18:25:10 GMT https://vulnogram.org/CVE-2022-40634 https://vulnogram.org/CVE-2022-40634 Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI. Medium Tue, 13 Sep 2022 18:25:09 GMT https://vulnogram.org/CVE-2021-23267 https://vulnogram.org/CVE-2021-23267 Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods. High Mon, 16 May 2022 17:05:25 GMT https://vulnogram.org/CVE-2021-23266 https://vulnogram.org/CVE-2021-23266 An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator. Medium Network Exploitable Mon, 16 May 2022 17:05:24 GMT https://vulnogram.org/CVE-2021-23265 https://vulnogram.org/CVE-2021-23265 A logged-in and authenticated user with a Reviewer Role may lock a content item. Low Mon, 16 May 2022 17:05:22 GMT https://vulnogram.org/CVE-2021-23264 https://vulnogram.org/CVE-2021-23264 Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes. High Network Exploitable Thu, 02 Dec 2021 15:40:59 GMT https://vulnogram.org/CVE-2021-23263 https://vulnogram.org/CVE-2021-23263 Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). Medium Network Exploitable Thu, 02 Dec 2021 15:40:58 GMT https://vulnogram.org/CVE-2021-23262 https://vulnogram.org/CVE-2021-23262 Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE. Medium Thu, 02 Dec 2021 15:40:57 GMT https://vulnogram.org/CVE-2021-23261 https://vulnogram.org/CVE-2021-23261 Authenticated administrators may override the system configuration file and cause a denial of service. Medium Thu, 02 Dec 2021 15:40:56 GMT https://vulnogram.org/CVE-2021-23260 https://vulnogram.org/CVE-2021-23260 Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site. Medium Thu, 02 Dec 2021 15:40:56 GMT https://vulnogram.org/CVE-2021-23259 https://vulnogram.org/CVE-2021-23259 Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary comma… Medium Thu, 02 Dec 2021 15:40:55 GMT https://vulnogram.org/CVE-2021-23258 https://vulnogram.org/CVE-2021-23258 Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE). Medium Thu, 02 Dec 2021 15:40:54 GMT https://vulnogram.org/CVE-2020-25803 https://vulnogram.org/CVE-2020-25803 Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0… Medium Tue, 06 Oct 2020 14:21:40 GMT https://vulnogram.org/CVE-2020-25802 https://vulnogram.org/CVE-2020-25802 Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to… Medium Tue, 06 Oct 2020 14:09:25 GMT