Code injection in Craftcms Craft Cms
CVSS score
10.0
EPSS probability
%99.8
Risk score
20.0
Published
1 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Working PoC + debugging writeup for CVE-2025-32432 (Craft CMS pre-auth RCE)
Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail
A simple PoC on the Remote Code Execution (RCE) Vulnerability of CraftCMS designated as CVE-2025-32432 written in Go
Craft CMS CVE-2025-32432 command runner adapted from Nicolas Bourras and Orange Cyberdefense research
Working PoC for CVE-2025-32432 - Craft CMS <= 5.6.16 unauthenticated RCE via Yii2 PhpManager gadget + nginx access.log poisoning
Nuclei: CraftCMS - Remote Code Execution
https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/
Similar Vulnerabilities
Authenticated RCE via `condition.config` JSON cleanse bypass
Vulnerability in Craftcms Craft Cms
Craft CMS before 5.10.12 Remote Code Execution via element-index
Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config
Vulnerability in Craftcms Craft Cms
Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-32432"