Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
1,968 results · Clear filters · Feed
-
High 7.5
[20220301] - Core - Zip Slip within the Tar extractor
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.
-
High 7.4
Old sessions are not blocked by the login enable function. in snipe/snipe-it
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.
-
High 8.1
Path Traversal in ImpressCMS
ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.
-
High —
Arbitrary shell execution
A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option
-
High —
Arbitrary shell execution
Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases
-
High 8.8
SQL Injection in Moodle
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
-
High 7.5
SQL Injection in Yeswiki
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.
-
High 7.5
Improper Input Validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are current…
-
High 8.2
Insufficient Session Expiration in admidio/admidio
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.
-
High 7.1
Cross-site Scripting (XSS) - Stored in getgrav/grav
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
-
High 7.2CVE-2022-0968 Scanner template
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber pri…
-
High 8.0
Stored XSS viva .webmv file upload in star7th/showdoc
Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.
-
High 7.1
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.
-
High 7.6
Stored XSS via File Upload in star7th/showdoc
Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
-
High 7.1
Stored XSS via File Upload in star7th/showdoc
Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.
-
High 8.2
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
-
High 8.2
File Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdoc
File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.
-
High 7.1
Insufficient Session Expiration in Sylius
Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and un…
-
High 7.3
Stored XSS due to Unrestricted File Upload in star7th/showdoc
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
-
High 7.1
Stored XSS via file upload in star7th/showdoc
Stored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4.
-
High 8.0
File upload filter bypass leading to stored XSS in microweber/microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
-
High 7.1
File upload filter bypass leading to stored XSS in microweber/microweber
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
-
High 7.6
Cross-site Scripting (XSS) - Stored in star7th/showdoc
Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.
-
High 7.2
Moodle Blind SQL injection possible via MNet authentication
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.…
-
High 7.2
Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.
-
High 7.5
Moodle denial-of-service risk in the draft files area
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
-
High 8.8CVE-2021-44673 Public exploit
Unrestricted Upload of File with Dangerous Type in Croogo
A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script.
-
High 7.7
Static Code Injection in microweber/microweber
Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
-
High 7.1
Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
-
High 7.3
Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube
alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is miti…
-
High 7.6
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.
-
High 8.8CVE-2020-18326 Public exploit
Cross Site Request Forgery in intelliants/subrion
Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary …
-
High 7.2CVE-2022-0819 EPSS 43%
Code Injection in dolibarr/dolibarr
Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.
-
High 7.3
Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber
Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.
-
High 8.6
Server-Side Request Forgery (SSRF) in rudloff/alltube
Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.
-
High 8.0
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.
-
High 7.2CVE-2022-26149 Public exploit
Unrestricted Upload of File with Dangerous Type in MODX Revolution
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
-
High 8.1
Multi-Factor Authentication issue in Laravel Fortify
Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
-
High 7.2CVE-2022-21705 Scanner template
Authenticated remote code execution in octobercms
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vu…
-
High 8.8
Insertion of Sensitive Information Into Debugging Code in microweber/microweber
Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.