Ecosystem
Packagist
7,190 known vulnerabilities.
Most affected packages
108 results · Clear filters · Feed
-
Critical 9.8
Code injection in codiad
Codiad Web IDE through 2.8.4 allows PHP Code injection.
-
Critical 9.8CVE-2019-19634 Public exploit
class.upload.php in verot.net omits .pht from the set of dangerous file extensions
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
-
Critical 9.8
Remote code execution in verot/class.upload.php
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
-
Critical 9.8CVE-2019-14537 Public exploit
Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
-
Critical 9.8
LibreNMS arbitrary OS commands execution
LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=l…
-
Critical 9.8
Magento 2 Community Edition SQLi Vulnerability
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
-
Critical 9.8
elFinder command injection vulnerability in the PHP connector
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
-
Critical 9.8
PHAR stream wrapper Arbitrary PHP code execution
In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, c…
-
Critical 9.8
TCPDF vulnerable to attackers triggering deserialization of arbitrary data
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
-
Critical 9.8CVE-2018-16385 Public exploit
ThinkPHP SQL Injection vulnerability
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.
-
Critical 9.8
Codiad remote code execution vulnerability
Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689.
-
Critical 9.8
Dolibarr SQL injection vulnerability
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.
-
Critical 9.8
Drupal Core Remote Code Execution Vulnerability
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
KEV Nov 3, 2021 -
Critical 9.8
Bacula-web SQL Injection Vulnerabilities
Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.
-
Critical 9.8
Anchor CMS Logs Credentials
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
-
Critical 9.8CVE-2015-3933 Public exploit
MetalGenix GeniXCMS vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.
-
Critical 9.8
CodeIgniter and Kohana vulnerable to PHP Object Injection
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare…
-
Critical 9.8CVE-2017-11366 Public exploit
Codiad Vulnerable to Shell Command Injection
components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.
-
Critical 9.8
Code Injection in PHPUnit
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., ex…
KEV Feb 15, 2022 -
Critical 9.8CVE-2015-7564 Public exploit
TeamPass vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) c…
-
Critical 9.8
Moodle SQL injection via user preferences
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
-
Critical 9.8CVE-2016-4861 Public exploit
Zend Framework Allows SQL Injection
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
-
Critical 9.8
Remote code execution in PHPMailer
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping perf…
-
Critical 9.8
zend-mail remote code execution via Sendmail adapter
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute ar…
-
Critical 9.8
Remote code execution in PHPMailer
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
KEV Jul 7, 2025 -
Critical 9.8
Swift Mailer mail transport Command Injection
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address…
-
Critical 9.8
phpMyAdmin Code Injection vulnerability
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted strin…
-
Critical 9.1
Zend Framework XXE Vulnerability
Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element …