CVE-2023-36260

An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security."

• CWE-74

• https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28
• https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29Broken Link
• https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3DThird Party Advisory
• https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28
• https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29Broken Link
• https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3DThird Party Advisory

Published

Jan 30, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36252An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows…8.8
• CVE-2023-36255An issue in Eramba Limited Eramba Enterprise and Community e…8.8
• CVE-2023-36256The Online Examination System Project 1.0 version is vulnera…6.5
• CVE-2023-36258An issue in LangChain before 0.0.236 allows an attacker to e…9.8
• CVE-2023-36259Cross Site Scripting (XSS) vulnerability in Craft CMS Audit …5.4
• CVE-2023-3626A vulnerability, which was classified as critical, has been …9.8
• CVE-2023-36262Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-36263Prestashop opartlimitquantity 1.4.5 and before is vulnerable…9.8
• CVE-2023-36266An issue was discovered in Keeper Password Manager for Deskt…5.5
• CVE-2023-36268Rejected reason: DoS issues, or unexploitable crashes, are o…
• CVE-2023-3627Cross-Site Request Forgery (CSRF) in GitHub repository sales…8.8
• CVE-2023-36271LibreDWG v0.10 to v0.12.5 was discovered to contain a heap b…8.8