Processwire

CVE-2026-40500 Apr 15, 21:25 PHP MEDIUM POC This Month

Server-side request forgery in ProcessWire CMS 3.0.255 and prior allows authenticated administrators to abuse the 'Add Module From URL' feature to issue outbound HTTP requests to arbitrary internal or external hosts. This enables internal network reconnaissance, port scanning, and potential access to cloud metadata endpoints. A public exploit exists but requires admin credentials, limiting real-world risk.

CVE-2024-41597 Jul 19, 20:15 PHP MEDIUM POC This Month

Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

CVE-2022-40488 Oct 31, 12:15 PHP MEDIUM PATCH This Month

ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-40487 Oct 31, 12:15 PHP MEDIUM PATCH This Month

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.