Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
1,968 results · Clear filters · Feed
-
High 8.8
Dolibarr vulnerable to remote code execution via uppercase manipulation
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.
-
High 7.1CVE-2023-2859 Public exploit
Code Injection in nilsteampassnet/teampass
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
-
High 7.2
Remote Code Execution via unrestricted file extension in Craft CMS
Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTemp…
-
High 7.2
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
-
High 7.2
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
-
High 8.8CVE-2023-32073 Public exploit
AVideo command injection vulnerability
WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-…
-
High 7.5
Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis
Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
-
High 8.8
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
-
High 7.1CVE-2023-2591 Public exploit
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nilsteampassnet/teampass
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
-
High 8.0
WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account
WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting…
-
High 7.3
Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast
Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.
-
High 8.2
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
-
High 8.8CVE-2023-30854 Public exploit
WWBN AVideo vulnerable to OS Command Injection
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.
-
High 8.8
Pimcore SQL Injection Vulnerability in Admin Translations API
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch …
-
High 8.8
Pimcore vulnerable to SQL Injection in Translation Export API
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch …
-
High 8.8
Pimcore SQL Injection Vulnerability in Admin Search Find API
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.
-
High 7.3
Cross-site Scripting (XSS) - Generic in pimcore/pimcore
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
-
High 7.2
SQL Injection in pimcore/pimcore
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.
-
High —
Cross site scripting (XSS) in wwbn/avideo
Description: While making an account in demo.avideo.com I found a parameter "?success=" which did not sanitize any symbol character properly which leads to XSS attack. Impact: Since there's an Admin account on demo.avideo.com attacker can use this attack to T…
-
High 7.2
Drupal core arbitrary PHP code execution
Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for…
-
High 7.5
Drupal core Information Disclosure vulnerability
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored …
-
High 7.5
Improper input validation in Drupal core
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certa…
-
High 8.6
PrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML method
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pr…
-
High 7.7
PrestaShop arbitrary file read vulnerability
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function …
-
High 7.5
Laminas Diactoros vulnerable to HTTP Multiline Header Termination
Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the…
-
High 8.8
Improper Privilege Management in microweber/microweber
Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.
-
High 7.1
Exposure of Private Personal Information to an Unauthorized Actor in microweber/microweber
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.
-
High 8.8
Improper Control of Generation of Code in Twig Rendered Views in Shopware
Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension t…
-
High 8.1
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 8.9
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 8.1
Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 8.3
Business Logic Errors in thorsten/phpmyfaq
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 8.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 7.3
Authentication Bypass by Capture-replay in thorsten/phpmyfaq
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 8.3CVE-2023-1880 Scanner template
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 7.4
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
-
High 8.8
Uvdesk remote code execution vulnerability
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.
-
High 7.2
Improper Privilege Management in thorsten/phpmyfaq
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 8.4
Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 8.1
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.