Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 44
Reset filtersStatamic vulnerable to privilege escalation via stored cross-site scripting
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
Statamic's missing authorization allows access to email addresses
Statamic Vulnerable to Server-Side Request Forgery via Glide
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
Statamic is vulnerable to account takeover via password reset link injection
Statamic affected by privilege escalation via stored cross-site scripting
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
Statamic CMS's missing authorization allows access to assets
Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation
Statamic CMS has a Path Traversal in Asset Upload
Password confirmation stored in plain text via registration form in statamic/cms
Statmic CMS vulnerable to account takeover via XSS and password reset link
Cross-site Scripting via uploaded assets
Statamic CMS vulnerable to remote code execution via form uploads
Statamic CMS remote code execution via front-end form uploads
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
Statamic framework Incorrect Permission Assignment
Discoverability of user password hash in Statamic CMS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.