{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-12T22:02:30.901","vulnerabilities":[{"cve":{"id":"CVE-2026-25496","sourceIdentifier":"security-advisories@github.com","published":"2026-02-09T20:15:58.223","lastModified":"2026-02-19T19:17:02.927","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. This issue is patched in versions 4.16.18 and 5.8.22."},{"lang":"es","value":"Craft es una plataforma para crear experiencias digitales. En las versiones de Craft 4.0.0-RC1 hasta 4.16.17 y 5.0.0-RC1 hasta 5.8.21, existe una vulnerabilidad de XSS almacenado en la configuración del tipo de campo Número. Los campos Prefijo y Sufijo se renderizan utilizando el filtro Twig |md|raw sin el escape adecuado, lo que permite la ejecución de scripts cuando el campo Número se muestra en los perfiles de los usuarios. Este problema está parcheado en las versiones 4.16.18 y 5.8.22."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*","versionStartExcluding":"4.0.0","versionEndExcluding":"4.16.18","matchCriteriaId":"29EBFBEA-6CFF-49DD-BEE0-3E65E89DEA2E"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*","versionStartExcluding":"5.0.0","versionEndExcluding":"5.8.22","matchCriteriaId":"E1C69442-81E7-4695-B09C-E7811765D283"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*","matchCriteriaId":"610F6DE9-720F-45B3-81D5-18E7F6B090FD"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"CC2F40FC-7C27-456A-B16D-679410D1D5CF"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*","matchCriteriaId":"FBAA8227-04F8-404C-907B-B0162B325F5A"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*","matchCriteriaId":"21B28E2C-327A-4CE6-ACAD-97E459712A55"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*","matchCriteriaId":"1C7461CF-35AB-48E1-88B6-956DAE1D2AB4"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"8D8E02D1-601A-4E2B-B619-4775BFDB72D0"}]}]}],"references":[{"url":"https://github.com/craftcms/cms/commit/cb5fb0e979e72f315c9178fc031883d49527f513","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/craftcms/cms/releases/tag/5.8.22","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-9f5h-mmq6-2x78","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory","Patch"]}]}}]}