CVE-2024-37843: Craft CMS

Critical severity, CVSS 9.8. EPSS: 53.2% chance of exploitation in the next 30 days.

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

Affected products

• Craft CMS Craft CMS: before 3.7.31 (fixed in 3.7.31)

Published 2024-06-25. Last modified 2026-06-17.