Murasoftware - vulnerabilities (CVEs)

9 CVEs in 1 products, 0 in the last 30 days, newest from 2026-03-18.

Products

• Mura Cms - 9 CVEs

Newest CVEs of Murasoftware

• CVE-2025-67830 - CVSS 9.8 (critical), 2026-03-18: Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection.
• CVE-2025-67829 - CVSS 9.8 (critical), 2026-03-18: Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection.
• CVE-2025-55043 - CVSS 6.5 (medium), 2026-03-18: MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated…
• CVE-2025-55046 - CVSS 8.1 (high), 2026-03-18: MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a…
• CVE-2025-55041 - CVSS 8 (high), 2026-03-18: MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows…
• CVE-2025-55045 - CVSS 7.1 (high), 2026-03-18: The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable…
• CVE-2025-55040 - CVSS 8.8 (high), 2026-03-18: The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The…
• CVE-2025-55044 - CVSS 8.8 (high), 2026-03-18: The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through…
• CVE-2022-47003 - CVSS 9.8 (critical), 2023-02-01: A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.