Ecosystem
Packagist
7,164 known vulnerabilities.
Most affected packages
7,154 results · Feed
-
Medium 4.3
Winter: My Account preview exposes another backend user's profile by record ID
Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions …
-
Low 2.0
Winter CMS: Stored XSS through Backend List widget image columns
Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without esca…
-
Medium 4.5
Winter: Reflected XSS through the search query parameter in the backend Table widget
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script …
-
Medium 6.1
Winter: CSRF through AJAX handler names reachable as backend page actions
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing bac…
-
Medium 4.5
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a…
-
High 8.3
Winter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dis…
-
Medium 5.9
FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files
FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distin…
-
Medium 5.4
FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current …
-
High 8.8
Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter
Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the loc…
-
Unscored —
The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal_utilities/htmLawed/ind…
-
Unscored —
The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal_utilities/htmLawed/ind…
-
Unscored —
Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user wi…
-
Unscored —
The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditio…
-
Unscored —
This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site. The module does not sufficientl…
-
Unscored —
The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module. T…
-
Unscored —
The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently …
-
Unscored —
The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. …
-
Unscored —
This module provides a separate page with a form for users to change their own password, which asks for the current pas…
-
Unscored —
This module enables you to schedule content to be published or unpublished at a certain time in the future. The module …
-
Unscored —
This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The …
-
Unscored —
The Name Field module provides a field for storing a personal name as separate components. The module does not sufficie…
-
Unscored —
This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access fo…
-
Unscored —
This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently ver…
-
Unscored —
This module lets customers replace an item in their cart with one of the alternative product variations listed for it. …
-
Unscored —
The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from Pa…
-
Unscored —
This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't suffici…
-
Unscored —
The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly re…
-
Unscored —
This module enables you to send messages ("Notifications") to users upon a certain Workflow state change. The module do…
-
Unscored —
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with …
-
Unscored —
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypas…
-
Unscored —
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive fi…
-
Unscored —
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive fi…
-
Medium 4.2
Silverstripe MFA: Can bypass MFA during password reset flow
Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is c…
-
Medium —
AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE
### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to cr…
-
High 8.1
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list dr…
-
High 8.2
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
### Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attack…
-
High —
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
## Summary AdminNeo inserts the database server's version string into a `<script>` tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes…
-
High 7.2
AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
## Summary Adminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An au…
-
Medium 6.8
AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
### Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token (via network sniffing, log files, …
-
High 7.5
AdminNeo: version-cache array injection causes persistent denial of service
AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `…