Ecosystem
Packagist
7,188 known vulnerabilities.
Most affected packages
438 results · Clear filters · Feed
-
Critical 9.8
Codiad remote code execution vulnerability
Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689.
-
High 8.8
phpMyAdmin Improper Authentication
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an impro…
-
Medium 4.8CVE-2018-11564 Public exploit
Pagekit Stored Cross-site Scripting
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will …
-
High 8.8
Moodle calculated question type allows remote code execution by Question authors
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
-
Critical 9.8
Dolibarr SQL injection vulnerability
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.
-
Medium 6.1CVE-2018-10366 Public exploit
User Plugin for October CSS Allows XSS
An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
-
High 8.8CVE-2018-10188 Public exploit
phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.
-
Medium 4.8CVE-2018-6905 Public exploit
Typo3 XSS Vulnerability
The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.
-
Critical 9.8
Drupal Core Remote Code Execution Vulnerability
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
KEV Nov 3, 2021 -
High 7.5
Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0
rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.
-
Critical 9.8
Bacula-web SQL Injection Vulnerabilities
Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.
-
Critical 9.8
Anchor CMS Logs Credentials
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
-
Medium 6.1CVE-2018-7198 Public exploit
October CMS - RainLab Blog Plugin XSS
October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.
-
Medium 6.5
Moodle SSRF Vulnerability
Moodle 3.x has Server Side Request Forgery in the filepicker.
-
High 8.8CVE-2017-1000499 Public exploit
phpMyAdmin CSRF Vulnerability
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
-
High 8.1
Zeta Components Mail Arbitrary code execution via a crafted email address
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email …
-
Medium 5.4CVE-2017-16807 Public exploit
Kirby XSS Vulnerability
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
-
Critical 9.8CVE-2015-3933 Public exploit
MetalGenix GeniXCMS vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.
-
High 8.8CVE-2017-16244 Public exploit
October CMS CSRF
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving …
-
Medium 6.1CVE-2017-15374 Public exploit
Shopware XSS Vulnerability
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to p…
-
Medium 5.4CVE-2017-15284 Public exploit
OctoberCMS Cross-Site Scripting
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context …
-
High 7.2
October CMS PHP Code Execution
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
-
Critical 9.8
CodeIgniter and Kohana vulnerable to PHP Object Injection
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare…
-
Critical 9.8CVE-2017-11366 Public exploit
Codiad Vulnerable to Shell Command Injection
components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.
-
Medium 6.1CVE-2017-11503 Public exploit
Cross-site scripting in PHPMailer
PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.
-
High 8.8CVE-2017-6086 Public exploit
ViMbAdmin CSRF Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request …
-
Critical 9.8
Code Injection in PHPUnit
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., ex…
KEV Feb 15, 2022 -
Medium 5.4CVE-2017-9516 Public exploit
Craft CMS XSS Vulnerability
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
-
Medium 6.5CVE-2017-7620 Public exploit
MantisBT vulnerable to CSRF and Open Redirect attacks
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to …
-
Medium 4.5CVE-2017-8382 Public exploit
admidio CSRF Vulnerability
admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts.
-
High 8.8
MantisBT allows arbitrary password reset
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
-
Medium 6.1CVE-2017-7725 Public exploit
Concrete CMS vulnerable to cross-site scripting (XSS)
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain na…
-
Critical 9.8CVE-2015-7564 Public exploit
TeamPass vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) c…
-
Medium 6.1CVE-2015-7562 Public exploit
TeamPass vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.
-
Critical 9.8
Moodle SQL injection via user preferences
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
-
Medium 5.3CVE-2017-6370 Public exploit
TYPO3 Information Disclosure Vulnerability
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
-
Critical 9.8CVE-2016-4861 Public exploit
Zend Framework Allows SQL Injection
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
-
High 7.5
PEAR core file overwrite vulnerability
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
-
High 7.5CVE-2017-5594 Public exploit
Pagekit Weak Password Recovery Mechanism for Forgotten Password
An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID …
-
High 7.5CVE-2016-4793 Public exploit
CakePHP allows remote attackers to spoof their IP
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.