CVE Watch—

CVE-2025-23209

Craft CMS Code Injection Vulnerability

CVSS

—

Sem CVSS

EPSS

21.6%

p98

KEV

SIM

20 de fev. de 2025

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

21.6%EPSS · 30 dias21.8%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Craft CMS / Craft CMS

Vulnerabilidade

Craft CMS Code Injection Vulnerability

Adicionado ao KEV

20 de fev. de 2025

Corrigir até

13 de mar. de 2025

Uso conhecido em ransomware

Não

Descrição resumida

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.

Ação necessária

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x ; https://nvd.nist.gov/vuln/detail/CVE-2025-23209

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2025-3243210.0 CRÍ

100.0%

KEV—80Craft CMS Code Injection Vulnerability42d CVE-2024-56145—

99.9%

KEV—80Craft CMS Code Injection Vulnerability—CVE-2025-35939—

71.6%

KEV—71Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability—