Ecosystem
Packagist
7,191 known vulnerabilities.
Most affected packages
3,767 results · Clear filters · Feed
-
Medium 5.5
Path Traversal in pimcore/pimcore
Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.
-
Medium 5.2
Cross-site Scripting (XSS) - DOM in pimcore/pimcore
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
-
Medium 5.2
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
-
Medium 4.0
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
-
Medium 6.1
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
-
Medium 5.4
Cross-site scripting vulnerabilities in old version of bundled TinyMCE
An old version of TinyMCE include an XSS vulnerability, which was patched in a later version. This was described by TinyMCE: > A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript executi…
-
Medium 5.4
Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author…
-
Medium 4.3
Silverstripe Framework has missing permission check of canView in GridFieldPrintButton
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author …
-
Medium 6.5
Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security relea…
-
Medium 5.4
Access bypass in Drupal core
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but w…
-
Medium 6.1
Lack of domain validation in Druple core
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulner…
-
Medium 6.5
Access bypass in Drupal Core
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added…
-
Medium 4.3
contao/core-bundle has path traversal vulnerability in the file manager
Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these f…
-
Medium 6.1
Cross Site Scripting in CraftCMS
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
-
Medium 4.8
Cross-site Scripting in Backdrop CMS
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as a…
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 5.3
Improper Input Validation in nyholm/psr7
### Impact Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. ### P…
-
Medium 5.3
Improper header validation in httpsoft/http-message
### Impact Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. ### P…
-
Medium 4.6
Improper Access Control in francoisjacquet/rosariosis
Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.
-
Medium 6.1CVE-2022-48150 Public exploit
Shopware vulnerable to cross-site scripting (XSS)
Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.
-
Medium 6.5
Insecure header validation in slim/psr7
slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many server…
-
Medium 5.3
Improper header name validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is u…
-
Medium 5.4
Improper Access Control in alextselegidis/easyappointments
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 4.3
Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 5.4
Session Fixation in alextselegidis/easyappointments
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 5.8
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3.
-
Medium 5.3
Cross-site Scripting (XSS) - Generic in microweber/microweber
Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.
-
Medium 6.3
yuan1994 tpAdmin Upload.php remote server-side request forgery
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-…
-
Medium 6.3
yuan1994 tpAdmin Upload.php Upload unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in yuan1994 tpAdmin 1.3.12. This issue affects the function Upload of the file application\admin\controller\Upload.php. The manipulation of the argument file …
-
Medium 4.7
Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 5.4
Improper Access Control in thorsten/phpmyfaq
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 4.7
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 5.4
Insufficient Session Expiration in firefly-iii/firefly-iii
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
-
Medium 4.7
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 6.1
Command Injection in microweber/microweber
Command Injection in GitHub repository microweber/microweber prior to 1.3.3.
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 6.1
Uvdesk vulnerable to stored cross-site scripting (XSS)
Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.
-
Medium 6.1
Silverstripe Form Capture vulnerable to Stored Cross-Site Scripting
Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowe…
-
Medium 6.1
Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name
Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen …