Ecosystem
Packagist
7,191 known vulnerabilities.
Most affected packages
3,767 results · Clear filters · Feed
-
Medium 5.3
Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
-
Medium 4.8
Moodle vulnerable to Stored Cross-site Scripting
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.
-
Medium 5.3
Moodle Improper Input Validation vulnerability
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.
-
Medium 5.3
Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.
-
Medium 5.3
Moodle has a Hidden Functionality vulnerability
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
-
Medium 5.5
Artesãos SEOTools TwitterCards.php eachValue redirect
A vulnerability was found in Artesãos SEOTools up to 0.17.1 and classified as critical. This issue affects the function eachValue of the file TwitterCards.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able …
-
Medium 5.5
Artesãos SEOTools SEOMeta.php setTitle redirect
A vulnerability has been found in Artesãos SEOTools up to 0.17.1 and classified as problematic. This vulnerability affects the function setTitle of the file SEOMeta.php. The manipulation of the argument title leads to open redirect. Upgrading to version 0.17.…
-
Medium 5.5
Artesãos SEOTools OpenGraph.php makeTag redirect
A vulnerability, which was classified as problematic, was found in Artesãos SEOTools up to 0.17.1. This affects the function makeTag of the file OpenGraph.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able …
-
Medium 6.1
Craft CMS stored cross-site scripting vulnerability
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.…
-
Medium 4.0
Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.
-
Medium 4.8
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
-
Medium 5.7
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
-
Medium 5.2
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
-
Medium 6.1
frp_form_answers allows Cross-site Scripting
The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails.
-
Medium 6.8
Cross-Site Request Forgery (CSRF) in froxlor/froxlor
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.
-
Medium 4.3
MantisBT: Exposure of Private issues' summary to unauthorized users
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the _Summary_ field of private Issues (i.e. having Private v…
-
Medium 6.1
Microweber vulnerable to Cross-site Scripting
Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload int…
-
Medium 4.3
Improper Authorization in pixelfed/pixelfed
Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in pixelfed/pixelfed
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.
-
Medium 6.1
Moodle: reflected xss risk in some returnurl parameters
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's…
-
Medium 6.1
Moodle: reflected xss risk in blog search
The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in co…
-
Medium —
Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug
### Impact An attacker can use XSS to send a malicious script to an unsuspecting user. ### Patches Update to version 10.5.17 or apply this patch manually https://github.com/pimcore/pimcore/pull/14301.patch ### Workarounds Apply https://github.com/pimcore/pimc…
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.
-
Medium 5.4
Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
-
Medium 6.5
Code Injection in thorsten/phpmyfaq
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
Medium 4.0
Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
-
Medium 6.3
webbuilders-group silverstripe-kapost-bridge KapostService.php getPreview sql injection
A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql inject…
-
Medium 4.8
Formwork Cross-site Scripting (XSS) from Page title field
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter.
-
Medium 5.3
Privilege Chaining in cockpit-hq/cockpit
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in wallabag/wallabag
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
-
Medium 4.6
Cross-site Scripting (XSS) - Stored in wallabag/wallabag
Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
-
Medium 5.9CVE-2022-24894 Public exploit
Symfony storing cookie headers in HttpCache
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the…
-
Medium 6.3
Symfony vulnerable to Session Fixation of CSRF tokens
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSR…
-
Medium 5.4
Cross site scripting in automad/automad
Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.
-
Medium 6.5
Improper Authorization in wallabag/wallabag
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
-
Medium 6.3
Cross-site Scripting (XSS) - DOM in microweber/microweber
Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
-
Medium 5.4
Improper Authorization in wallabag/wallabag
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.