Exploited vulnerabilities
Craft CMS
4 Craft CMS vulnerabilities in the CISA KEV catalogue: those for which the US cybersecurity agency has evidence of exploitation in real attacks.
In the catalogue4
Last 12 months1
In ransomware campaigns0
Last addition20 March 2026
The vulnerabilities4
- 20 March 2026CVE-2025-32432Craft CMSCraft CMS Code Injection Vulnerability
- 2 June 2025CVE-2025-35939Craft CMSCraft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
- 2 June 2025CVE-2024-56145Craft CMSCraft CMS Code Injection Vulnerability
- 20 February 2025CVE-2025-23209Craft CMSCraft CMS Code Injection Vulnerability
Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.
Alerts only on the products you use
With My Defence you receive alerts and briefings only on the products you use, Craft CMS included.