Processwire

Processwire

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.8

CVE-2026-40500

Exploit
  • EPSS 0.39%
  • Veröffentlicht 15.04.2026 21:25:53
  • Zuletzt bearbeitet 09.07.2026 23:17:05

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The "Add Module from URL" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via sta...

6.5

CVE-2025-60790

Exploit
  • EPSS 0.4%
  • Veröffentlicht 21.10.2025 00:00:00
  • Zuletzt bearbeitet 07.11.2025 20:08:57

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.

4.2

CVE-2024-41597

Exploit
  • EPSS 0.21%
  • Veröffentlicht 19.07.2024 20:15:08
  • Zuletzt bearbeitet 09.07.2026 14:16:25

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fe...

7.2

CVE-2023-24676

Exploit
  • EPSS 1.31%
  • Veröffentlicht 24.01.2024 21:15:08
  • Zuletzt bearbeitet 17.10.2025 18:15:35

An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is ab...

6.1

CVE-2022-40487

  • EPSS 0.41%
  • Veröffentlicht 31.10.2022 12:15:10
  • Zuletzt bearbeitet 09.07.2026 01:17:44

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a craft...

6.5

CVE-2022-40488

  • EPSS 0.27%
  • Veröffentlicht 31.10.2022 12:15:10
  • Zuletzt bearbeitet 09.07.2026 01:17:44

ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).

7.8

CVE-2020-27467

Exploit
  • EPSS 15.74%
  • Veröffentlicht 24.02.2022 15:15:21
  • Zuletzt bearbeitet 21.11.2024 05:21:14

A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.