Packagist

14 results · Clear filters · Feed

• Low 3.3
  CVE-2026-13233 Public exploit

  OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

  Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.

  Drupal OpenAI Provider drupal/ai_provider_openai Packagist
  Jul 10, 2026
• Low 2.3
  CVE-2026-8347 Public exploit

  Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog

  Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog.  This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express an…

  Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  May 22, 2026
• Low 1.2
  CVE-2025-69210 Public exploit

  FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

  FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality. Authenticated users can upload crafted XML files co…

  NeoRazorX facturascripts facturascripts/facturascripts Packagist
  Dec 30, 2025
• Low 3.7
  CVE-2025-51586 Public exploit

  Presta Shop vulnerable to email enumeration

  An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.

  prestashop/prestashop Packagist
  Sep 8, 2025
• Low 2.0
  CVE-2025-8573 Public exploit

  Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page

  Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page.  Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete …

  Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  Aug 5, 2025
• Low 2.4
  CVE-2024-11954 Public exploit

  Pimcore Search Document cross site scripting

  A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The …

  pimcore/pimcore Packagist
  Jan 28, 2025
• Low 2.0
  CVE-2024-1247 Public exploit

  Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field

  Concrete CMS version 9 before 9.2.5 is vulnerable to  stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which mig…

  Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  Feb 9, 2024
• Low 2.0
  CVE-2023-37269 Public exploit

  Winter CMS vulnerable to stored XSS through privileged upload of SVG file

  Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could …

  wintercms winter wintercms/winter Packagist
  Jul 7, 2023
• Low 3.5
  CVE-2018-25080 Public exploit

  MobileDetect Example session_example.php initLayoutType cross site scripting

  A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the function initLayoutType of the file examples/session_example.php of the component Example. The manipulation of the argument $_SERVER['PHP_SELF'…

  mobiledetect/mobiledetectlib Packagist
  Feb 4, 2023
• Low 3.5
  CVE-2022-0088 Public exploit

  Cross-Site Request Forgery (CSRF) in yourls/yourls

  Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.

  YOURLS yourls/yourls yourls/yourls Packagist
  Apr 3, 2022
• Low —
  CVE-2015-2269 Public exploit

  Moodle XSS Vulnerability

  Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2…

  moodle/moodle Packagist
  Jun 1, 2015
• Low —
  CVE-2014-3544 Public exploit

  Moodle cross-site scripting (XSS) vulnerability

  Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype I…

  moodle/moodle Packagist
  Jul 29, 2014
• Low —
  CVE-2014-3551 Public exploit

  Moodle multiple cross-site scripting (XSS) vulnerabilities

  Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web s…

  moodle/moodle Packagist
  Jul 29, 2014
• Low —
  CVE-2011-4340 Public exploit

  Symphony CMS vulnerable to Cross-site Scripting

  Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author privileges to inject arbitrary web script or HTML via (1) the profile parameter to extensions/profi…

  symphonycms/symphony-2 Packagist
  Feb 12, 2012