Skip to content
OpenAdvisories

Package · Packagist

codiad/codiad

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Low 3.1
    CVE-2017-20178

    Codiad process.php saveJSON information disclosure

    ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information…

    codiad/codiad Packagist
  • High 7.5
    CVE-2020-23355

    Codiad Vulnerable to PHP Magic Hash Vulnerability

    ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash …

    codiad/codiad Packagist
  • Medium 6.1
    CVE-2020-14042

    Codiad Cross-site Scripting Vulnerability

    ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanage…

    codiad/codiad Packagist
  • High 8.8
    CVE-2020-14043

    Codiad CSRF Vulnerability

    ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. The request to download a plugin from the marketplace is only available to admin users and it isn't CSRF protected in components/…

    codiad/codiad Packagist
  • High 7.2
    CVE-2020-14044

    Codiad SSRF Vulnerability

    ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class…

    codiad/codiad Packagist
  • Critical 9.8
    CVE-2019-19208 Public exploit EPSS 19%

    Code injection in codiad

    Codiad Web IDE through 2.8.4 allows PHP Code injection.

    codiad/codiad Packagist
  • Critical 9.8
    CVE-2018-14009 Public exploit EPSS 38%

    Codiad remote code execution vulnerability

    Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689.

    codiad/codiad Packagist
  • Critical 9.8
    CVE-2017-11366 Public exploit

    Codiad Vulnerable to Shell Command Injection

    components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.

    codiad/codiad Packagist