Skip to content
OpenAdvisories

Ecosystem

Packagist

7,190 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

3,767 results · Clear filters · Feed

  • Medium 5.4
    CVE-2024-50703

    TeamPass privileges issue

    TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.

    Teampass Teampass nilsteampassnet/teampass Packagist
  • Medium 5.4
    CVE-2024-50702

    TeamPass mail_me operation authorization issue

    TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.

    Teampass Teampass nilsteampassnet/teampass Packagist
  • Medium 4.8
    CVE-2024-54774

    Dcat Admin Cross-site Scripting (XSS) vulnerability

    Dcat Admin v2.2.0-beta contains a cross-site scripting (XSS) vulnerability in /admin/articles/create.

    dcat/laravel-admin Packagist
  • Medium 4.8
    CVE-2024-54775

    Dcat-Admin Cross-Site Scripting (XSS) vulnerability

    Dcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site Scripting (XSS) vulnerability via /admin/auth/menu and /admin/auth/extensions.

    dcat/laravel-admin Packagist
  • Medium 5.3
    CVE-2024-56361

    Stored Cross-Site Scripting (XSS) in lgsl v7.0

    LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identified in lgsl. The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a reque…

    tltneon lgsl tltneon/lgsl Packagist
  • Medium 5.4
    CVE-2024-56364

    Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx

    SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in 1.0.12 and ending in 1.1.13, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. This vulnerability is fixed in 1.1.13.

    shuchkin simplexlsx shuchkin/simplexlsx Packagist
  • Medium 4.9
    CVE-2024-55889 Public exploit

    phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames

    phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an <iframe> element wi…

    thorsten phpMyFAQ thorsten/phpmyfaq Packagist
  • Medium 6.8
    CVE-2024-55878

    Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

    SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issu…

    shuchkin simplexlsx shuchkin/simplexlsx Packagist
  • Medium 5.4
    CVE-2024-12393

    Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Medium 5.9
    CVE-2024-11942

    Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

    A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.

    Drupal Drupal core drupal/core drupal7 Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2024-53457 EPSS 46%

    LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section

    A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter.

    librenms/librenms Packagist
  • Medium —
    GHSA-4h8f-c635-25p7

    ibexa/post-install affected by Breach with Varnish VCL

    ### Impact This is not a vulnerability in the code per se, but included platform.sh Varnish VCL templates and Apache/Nginx vhost templates enable compression of API and JSON messages. This is a potential case of the BREACH vulnerability, which affects HTTP co…

    ibexa/post-install Packagist
  • Medium —
    GHSA-fh7v-q458-7vmw

    ibexa/http-cache affected by Breach with Varnish VCL

    ### Impact This is not a vulnerability in the code per se, but included Varnish VCL templates enable compression of API and JSON messages. This is a potential case of the BREACH vulnerability, which affects HTTP compression, where secrets can be extracted thr…

    ibexa/http-cache Packagist
  • Medium —
    GHSA-mgfg-7533-7jf6

    ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL

    ### Impact This is not a vulnerability in the code per se, but included Varnish VCL templates enable compression of API and JSON messages. This is a potential case of the BREACH vulnerability, which affects HTTP compression, where secrets can be extracted thr…

    ezsystems/ezplatform-http-cache Packagist
  • Medium 5.3
    CVE-2024-53864

    Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui

    Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is req…

    ibexa admin-ui ibexa/admin-ui Packagist
  • Medium 6.2
    CVE-2024-51058

    TCPDF Local File Inclusion vulnerability

    Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through <img> src tag, potentially exposing sensitive information.

    tcpdf tcpdf tecnickcom/tcpdf Debian Ubuntu Packagist
  • Medium 4.3
    CVE-2024-48899

    Moodle: idor when accessing list of course badges

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2024-45691

    Moodle: lesson activity password bypass through php loose comparison

    A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" value…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2024-45689

    Moodle: unprotected access to sensitive information via dynamic tables

    A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2024-52600

    Statamic CMS has Path Traversal in Asset Upload

    Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end…

    statamic cms statamic/cms Packagist
  • Medium 6.1
    CVE-2024-50803 Public exploit

    Redaxo Core CMS Cross Site Scripting (XSS)

    The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges

    redaxo/source Packagist
  • Medium 4.3
    CVE-2024-48901

    Moodle: idor when fetching report schedules

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2024-48898

    Moodle: some users can delete audiences of other reports

    A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2024-48897

    Moodle: idor in edit/delete rss feed

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2024-48896

    Moodle: users' names returned in messaging error message

    A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format conf…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.8
    CVE-2024-52526

    LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" tab of the Device page allows authenticated users to inject arbitrary JavaScript through the "descr" parameter when…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-51497

    LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Custom OID" tab of a device allows authenticated users to inject arbitrary JavaScript through the "unit" parameter when creat…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-51496

    LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "metric" parameter of the "/wireless" and "/health" endpoints allows attackers to inject arbitrary JavaScript. This vulnera…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-51495

    LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "overwrite_ip" parameter when editi…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-51494

    LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "descr" parameter when editing a de…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-50355

    LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can edit the Display Name of a device, the application did not properly sanitize the user input in the device Display Name, if java script code is inside the name…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-50352 EPSS 41%

    LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "name" pa…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-50351

    LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "section" parameter of the "logs" tab of a device allows attackers to inject arbitrary JavaScript. This vulnerability resul…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-50350

    LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when creating a ne…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-49764

    LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Capture Debug Information" page allows authenticated users to inject arbitrary JavaScript through the "hostname" parameter wh…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-49759

    LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "bill_name" parameter when cre…

    librenms librenms librenms/librenms Packagist
  • Medium 4.8
    CVE-2024-49758

    LibreNMS has a stored XSS in ExamplePlugin with Device's Notes

    LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the ExamplePlugin enable, if java script code is inside the device's Not…

    librenms librenms librenms/librenms Packagist
  • Medium 4.0
    CVE-2023-2332

    Stored Cross-site Scripting (XSS) in pimcore/pimcore

    A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scr…

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.5
    CVE-2023-0737

    CSRF in wallabag/wallabag

    wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Medium 4.3
    CVE-2021-3991

    Improper Authorization in dolibarr/dolibarr

    An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permiss…

    Dolibarr dolibarr/dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist