CyberSec.Space Logo
返回 CVE 浏览器

CVE-2024-56145

🔥 Known Exploited (CISA KEV)CRITICAL
9.3
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2024-12-18
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.

Affected Platforms (CPE)

📦
Craftcms

Craft Cms

>= 3.0.0 and < 3.9.14>= 4.0.0 and < 4.13.2>= 5.0.0 and < 5.5.2

References & Advisories

🔗 https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3
🔗 https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9
🔗 https://github.com/Chocapikk/CVE-2024-56145
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-56145

相关漏洞威胁

CVE-2026-579174.8

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing th...

CVE-2026-124959.2

Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G de...

CVE-2026-175345.5

Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist i...

CVE-2026-165545.1

cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_c...