PatchTheCVEmura cms vulnerabilities and fixes
Recent CVEs affecting mura cms, with upgrade or downgrade steps. 8 tracked.
Also searched as: muracms.
mura cms has 8 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-03-18. Highest priority: CVE-2025-67830 (score 46/100).
- CVE-2025-67830 CRITICAL 9.8 UPGRADE Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection.
- CVE-2025-67829 CRITICAL 9.8 UPGRADE Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection.
- CVE-2025-55046 HIGH 8.1 MITIGATE MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted
- CVE-2025-55045 HIGH 7.1 MITIGATE The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address i
- CVE-2025-55044 HIGH 8.8 MITIGATE The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content fr
- CVE-2025-55043 MEDIUM 6.5 MITIGATE MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc crea
- CVE-2025-55041 HIGH 8.0 MITIGATE MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (c
- CVE-2025-55040 HIGH 8.8 MITIGATE The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious
FAQ
How do I fix mura cms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mura cms being exploited right now?
None of the tracked mura cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mura cms CVE should I patch first?
CVE-2025-67830 currently ranks highest (46/100): Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection..