Actively exploited vulnerabilities affecting Craft CMS products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-32432https://wildfortech.com/security#CVE-2025-32432This vulnerability in Craft CMS allows unauthenticated remote attackers to inject and execute arbitrary code on affected servers. Because exploitation requires no credentials, any internet-facing Craft CMS installation is at serious risk of full server compromise. Successful exploitation could lead to data theft, site defacement, backdoor installation, or use of the server as a pivot point for further attacks within the network.Fri, 20 Mar 2026 00:00:00 GMTCraft CMSCraft CMShttps://wildfortech.com/security#CVE-2024-56145https://wildfortech.com/security#CVE-2024-56145Craft CMS contains a code injection flaw that allows attackers to execute arbitrary code remotely on affected servers. The vulnerability is specifically exploitable when the PHP runtime setting `register_argc_argv` is enabled in `php.ini` — a non-default but not uncommon configuration. If exploited, an attacker could gain full control of the web server environment, making this a critical risk for any organization running a vulnerable Craft CMS version with that PHP setting active.Mon, 02 Jun 2025 00:00:00 GMTCraft CMSCraft CMShttps://wildfortech.com/security#CVE-2025-35939https://wildfortech.com/security#CVE-2025-35939This Craft CMS flaw lets unauthenticated attackers manipulate web parameters to write arbitrary content — including PHP code — to known file locations on the server. On its own that's serious, but it becomes critical when chained with CVE-2024-58136 (tracked as CVE-2025-32432), which can turn this file-write primitive into full remote code execution. No login is required, meaning any internet-facing Craft CMS installation is at risk of complete server compromise.Mon, 02 Jun 2025 00:00:00 GMTCraft CMSCraft CMS