Vendor
iCagenda Unrestricted File Upload Vulnerability Leading to RCE (CVE-2026-48939)
1 rule 2 TTPs 5 CVEs 7 IOCsAttackers are actively exploiting CVE-2026-48939, an unrestricted file upload vulnerability in iCagenda, to upload malicious PHP code and achieve remote code execution on affected web servers.
Craft CMS RCE via Missing cleanseConfig in FieldsController
1 rule 1 TTPAn authenticated administrator in Craft CMS (versions 5.5.0 to 5.9.13) is vulnerable to Remote Code Execution (RCE) via a missing input sanitization vulnerability in the `actionRenderCardPreview()` method of `FieldsController`, allowing Yii2 event handler injection through specially crafted `fieldLayoutConfig` POST parameters, which enables arbitrary PHP code execution and sensitive information disclosure.
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
1 TTP 1 CVE 1 IOCAn attacker with only a GitHub account can plant a malicious JavaScript payload in a GitHub issue title, leading to a DOM Cross-Site Scripting (XSS) vulnerability (CVE-2026-55790) that executes in a Craft CMS administrator's control panel session when they use the CraftSupport widget and retrieve the poisoned issue, allowing for arbitrary JavaScript execution and potential unauthorized actions.
Craft CMS Authorship Spoofing via Authorization Bypass (CVE-2026-50279)
2 TTPs 1 CVEA low-privileged authenticated user can exploit CVE-2026-50279, an authorization bypass vulnerability in Craft CMS's `entries/save-entry` endpoint, to reassign an entry's authorship to another user without proper permissions, leading to corrupted audit trails and misleading content ownership.
Craft CMS Vulnerability Allows Low-Privilege Users to Delete Peer Assets
1 TTP 1 CVEA low-privilege user with `deleteAssets` permission in Craft CMS can bypass the `deletePeerAssets` check in the `AssetsController::actionDeleteFolder` function, allowing them to delete assets uploaded by other users (peer assets) within a shared volume, despite lacking the specific `deletePeerAssets` permission, leading to unauthorized data destruction.
Craft CMS Mass Assignment Vulnerability Allows Element Overwrites (CVE-2026-50281)
1 TTP 1 CVEA high-severity mass assignment vulnerability (CVE-2026-50281) in Craft CMS versions prior to 5.9.21 allows a low-privileged authenticated attacker to overwrite arbitrary existing element data, such as entries or user profiles, by manipulating the `newAttributes` parameter during a bulk duplication action.
Craft CMS Vulnerable to Unauthorized Folder Deletion (CVE-2026-50282)
1 TTP 1 CVEA high-severity vulnerability (CVE-2026-50282) in Craft CMS allows an authenticated user to delete destination folders and their contents without explicit delete permissions during a forced folder move operation, enabling asset loss, breaking existing asset references, and causing operational disruption.
Craft CMS GraphQL Address Resolver Missing Authorization Allows PII Disclosure
2 rules 1 TTPA missing authorization check in the GraphQL Address element resolver of Craft CMS Pro allows a GraphQL API token scoped to a low-privilege user group to read all addresses in the system, including those belonging to users in groups the token is not authorized to access, exposing personally identifiable information (PII).
Craft Commerce Blind SQL Injection via hasVariant/hasProduct Properties
3 rules 1 TTP 1 CVEA blind SQL injection vulnerability exists in Craft Commerce's `ProductQuery::hasVariant` and `VariantQuery::hasProduct` properties, allowing authenticated control panel users to extract arbitrary database contents and potentially escalate privileges.
Craft CMS Authenticated Remote Code Execution via Malicious Attached Behavior
2 rules 2 TTPsCraft CMS versions before 4.17.12 and 5.9.18 are vulnerable to authenticated remote code execution via malicious behavior injection in the field layout hydration path.