Processwire

Processwire

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.8

CVE-2026-40500

Exploit
  • EPSS 0.03%
  • Veröffentlicht 15.04.2026 21:25:53
  • Zuletzt bearbeitet 17.04.2026 15:38:09

ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causi...

6.5

CVE-2025-60790

Exploit
  • EPSS 0.12%
  • Veröffentlicht 21.10.2025 00:00:00
  • Zuletzt bearbeitet 07.11.2025 20:08:57

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.

4.2

CVE-2024-41597

Exploit
  • EPSS 0.27%
  • Veröffentlicht 19.07.2024 20:15:08
  • Zuletzt bearbeitet 09.07.2025 15:23:41

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality.

7.2

CVE-2023-24676

Exploit
  • EPSS 0.09%
  • Veröffentlicht 24.01.2024 21:15:08
  • Zuletzt bearbeitet 17.10.2025 18:15:35

An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is ab...

6.1

CVE-2022-40487

  • EPSS 0.5%
  • Veröffentlicht 31.10.2022 12:15:10
  • Zuletzt bearbeitet 06.05.2025 17:15:53

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a craft...

6.5

CVE-2022-40488

  • EPSS 0.33%
  • Veröffentlicht 31.10.2022 12:15:10
  • Zuletzt bearbeitet 06.05.2025 19:15:56

ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).

7.8

CVE-2020-27467

Exploit
  • EPSS 86.14%
  • Veröffentlicht 24.02.2022 15:15:21
  • Zuletzt bearbeitet 21.11.2024 05:21:14

A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.