Skip to content
OpenAdvisories

Ecosystem

Packagist

7,191 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

3,767 results · Clear filters · Feed

  • Medium 5.5
    CVE-2023-33196

    Craft CMS stored XSS in review volume

    Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.

    craftcms cms craftcms/cms Packagist
  • Medium 5.5
    CVE-2023-33197

    Craft CMS stored XSS in indexedVolumes

    Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

    craftcms cms craftcms/cms Packagist
  • Medium 5.4
    CVE-2023-2817

    Stored cross site scripting in Craft CMS

    A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Cat…

    craftcms/cms Packagist
  • Medium 6.7
    CVE-2023-2881

    Storing Passwords in a Recoverable Format in pimcore/customer-data-framework

    Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

    pimcore Pimcore Customer Data Framework pimcore/customer-management-framework-bundle Packagist
  • Medium 5.4
    CVE-2023-30124

    LavaLite vulnerable to Cross Site Scripting

    LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).

    lavalite/cms Packagist
  • Medium 5.3
    CVE-2023-26044

    ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits

    react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. Th…

    reactphp http react/http php-react-http Ubuntu Packagist
  • Medium 6.5
    CVE-2023-2756

    SQL Injection in pimcore/customer-data-framework

    SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

    pimcore Pimcore Customer Data Framework pimcore/customer-management-framework-bundle Packagist
  • Medium 6.3
    CVE-2023-2730

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.4
    CVE-2021-27131

    Moodle vulnerable to stored Cross-site Scripting

    Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal ad…

    moodle/moodle Packagist
  • Medium 6.1
    CVE-2023-27237

    LavaLite CMS vulnerable to host header injection attack

    LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.

    lavalite/cms Packagist
  • Medium 6.8
    CVE-2023-2666

    Allocation of Resources Without Limits or Throttling in froxlor/froxlor

    Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Medium 4.3
    CVE-2023-32075

    Pimcore vulnerable to Business Logic Errors in Customer automation rules

    The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be …

    pimcore customer-data-framework pimcore/customer-management-framework-bundle Packagist
  • Medium 5.4
    GHSA-r3fg-3r88-6x3f

    Ibexa User Settings are accessible on the front-end for anonymous user

    ### Impact This security advisory is about the user settings, which include things like preferred time zone and number of items per page in item listings. These could be accessed by the anonymous user. This impacted only the anonymous users themselves, and ha…

    ibexa/user Packagist
  • Medium 5.0
    CVE-2023-2629

    Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.

    pimcore Pimcore Customer Data Framework pimcore/customer-management-framework-bundle Packagist
  • Medium 6.8
    CVE-2023-2615

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.8
    CVE-2023-2614

    Cross-site Scripting (XSS) - DOM in pimcore/pimcore

    Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.7
    CVE-2023-2630

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.8
    CVE-2023-2616

    Cross-site Scripting (XSS) - Generic in pimcore/pimcore

    Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.1
    CVE-2023-31144

    Craft CMS vulnerable to cross site scripting in RSS feed widget

    Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.

    craftcms cms craftcms/cms Packagist
  • Medium 6.5
    CVE-2023-30855

    Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php

    Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this path traversal and arbitrary extension is limited to creation of arbitrary files and appending data to…

    pimcore pimcore pimcore/pimcore Packagist
  • Medium 5.4
    CVE-2023-2516 Public exploit

    Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

    Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • Medium 6.1
    CVE-2023-2427

    Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Medium 5.4
    CVE-2023-29918 Public exploit

    RosarioSIS vulnerable to CSV Injection

    RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

    francoisjacquet/rosariosis Packagist
  • Medium 6.5
    CVE-2023-30943 Public exploit Scanner template

    Moodle: tinymce loaders susceptible to arbitrary folder creation

    The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.6
    CVE-2023-30944

    Moodle: minor sql injection risk in external wiki method for listing pages

    The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL comman…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.6
    CVE-2023-2429

    Improper Access Control in thorsten/phpmyfaq

    Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Medium 6.1
    CVE-2023-2428

    Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Medium 5.4
    CVE-2023-28476

    Stored cross site scripting on tags

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-28471

    Stored cross site scripting via container name

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-28474

    Stored cross site scripting on saved presets

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.

    concrete5/concrete5 Packagist
  • Medium 5.3
    CVE-2023-28821

    Missing rate limit for password resets

    Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

    concrete5/concrete5 Packagist
  • Medium 5.5
    CVE-2023-28477

    Stored cross site scripting on API integration

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.

    concrete5/concrete5 Packagist
  • Medium 6.1
    CVE-2023-28475

    Reflected cross site scripting

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.

    concrete5/concrete5 Packagist
  • Medium 5.3
    CVE-2023-28472

    Concrete CMS missing secure cookie parameters

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies.

    concrete5/concrete5 Packagist
  • Medium 6.3
    CVE-2023-2361

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 4.4
    CVE-2023-30852

    Pimcore Arbitrary File Read in Admin JS CSS files

    Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the …

    pimcore pimcore pimcore/pimcore Packagist
  • Medium 5.2
    CVE-2023-2328

    Cross-site Scripting (XSS) - Generic in pimcore/pimcore

    Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.8
    CVE-2023-2323

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 4.0
    CVE-2023-2342

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.1
    CVE-2023-2339

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist