Ecosystem
Packagist
7,190 known vulnerabilities.
Most affected packages
3,767 results · Clear filters · Feed
-
Medium 6.1
Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: from 0.0.0 before 3.2.1.
-
Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security meas…
-
Medium 4.2
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the vic…
-
Medium 5.0
Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.
-
Medium 5.0
EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cross-Site Scripting (XSS).This issue affects EU Cookie Compliance (GDPR Compliance): from 0.0.0 before …
-
Medium 6.5
Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070
Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.
-
Medium —
Ibexa RichText Field Type XSS vulnerabilities in back office
### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vu…
-
Medium —
Ibexa Admin UI XSS vulnerabilities in back office
### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vu…
-
Medium —
Ibexa Admin UI assets XSS vulnerabilities in back office
### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vu…
-
Medium —
Ibexa eZ Platform Admin UI assets XSS vulnerabilities in back office
### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vu…
-
Medium —
Ibexa eZ Platform Admin UI XSS vulnerabilities in back office
### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vu…
-
Medium 6.5
Citizen allows stored XSS in search no result messages
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrar…
-
Medium 6.5
Citizen allows stored XSS in user registration date message
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impa…
-
Medium 6.5
Citizen allows stored XSS in menu heading message
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the D…
-
Medium 6.5
Citizen allows stored XSS in Command Palette tip messages
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impact…
-
Medium 6.5
Citizen allows stored XSS in preference menu headings
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.…
-
Medium 6.5
Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.
-
Medium 5.3
Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
-
Medium 5.3
Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
-
Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security meas…
-
Medium 6.5
HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the s…
-
Medium 6.0
Laravel Translation Manager Vulnerable to Stored Cross-site Scripting
Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can in…
-
Medium 5.1
Yii 2 Redis may expose AUTH paramters in logs in case of connection failure
The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and pas…
-
Medium 5.5
Froxlor has an HTML Injection Vulnerability
Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credent…
-
Medium 5.3
Chrome PHP is missing encoding in `CssSelector`
Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities. This is patched in v1.14.0. As a…
-
Medium 6.6
Laravel Rest Api has a Search Validation Bypass
Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across mul…
-
Medium 5.4
Open Redirect vulnerability on user unlock path
SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the deliv…
-
Medium 4.3
Segment cloning doesn't have a proper permission check
SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks. Insecure Direct Object Reference (IDOR) / M…
-
Medium 5.3
User name enumeration possible due to response time difference on password reset form
SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames. User Enumeration via Timing Attack: A user enum…
-
Medium 5.1
Mautic does not shield .env files from web traffic
SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This exposure could lead to the disclosure of sensitive information, including database credentials, API k…
-
Medium 6.5
Predictable Page Indexing Might Lead to Sensitive Data Exposure
SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive …
-
Medium 4.8
One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063
Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.
-
Medium 4.8
One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
-
Medium 4.8
One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
-
Medium 4.8
Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.
-
Medium 6.8
The Backup Plus extension for TYPO3 (ns_backup) allows command injections
The ns_backup extension through 13.0.0 for TYPO3 allows command injection.
-
Medium 6.4
[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability
The cs_seo extension through 9.2.0 for TYPO3 allows XSS.
-
Medium 5.3
The femanager TYPO3 extension allows Insecure Direct Object Reference
The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.
-
Medium 6.1
The Backup Plus extension for TYPO3 (ns_backup) allows XSS
The ns_backup extension through 13.0.0 for TYPO3 allows XSS.
-
Medium 5.4
TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer
TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web s…