Skip to content
OpenAdvisories

Ecosystem

Packagist

7,191 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

3,767 results · Clear filters · Feed

  • Medium 4.3
    CVE-2022-40316

    Moodle No groups filtering in H5P activity attempts report

    The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2022-40408

    FeehiCMS vulnerable to Cross-Site scripting via crafted payload

    FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module.

    feehi/feehicms Packagist
  • Medium 5.4
    CVE-2022-38975

    EC-CUBE DOM-based cross-site scripting vulnerability

    DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.

    EC-CUBE EC-CUBE 4 series ec-cube/ec-cube Packagist
  • Medium 5.4
    CVE-2022-40044

    Centreon contains cross-site scripting vulnerability via esc_name parameter

    Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via i…

    centreon/centreon Packagist
  • Medium 5.4
    CVE-2022-38073

    WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)

    Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.

    Awesome Support Team Awesome Support (WordPress plugin) awesome-support/awesome-support Web / CMS Packagist
  • Medium 5.4
    CVE-2022-37246

    Craft CMS Cross-site Scripting vulnerability

    Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.

    craftcms/cms Packagist
  • Medium 6.8
    CVE-2022-3255

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information…

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 4.3
    CVE-2022-3245

    Code Injection in display of tag title on saving tags in microweber/microweber

    HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 5.4
    CVE-2022-3005

    Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

    yetiforcecompany yetiforcecompany/yetiforcecrm yetiforce/yetiforce-crm Packagist
  • Medium 4.3
    CVE-2022-3242 Scanner template

    HTML code Injection in template search keyword in microweber/microweber

    Code Injection in GitHub repository microweber/microweber prior to 1.3.2.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.3
    CVE-2022-3004

    Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

    yetiforcecompany yetiforcecompany/yetiforcecrm yetiforce/yetiforce-crm Packagist
  • Medium 6.3
    CVE-2022-3000

    Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

    yetiforcecompany yetiforcecompany/yetiforcecrm yetiforce/yetiforce-crm Packagist
  • Medium 5.6
    CVE-2022-3231

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Medium 4.3
    CVE-2022-3173

    Improper Authentication in snipe/snipe-it

    Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.

    snipe snipe/snipe-it snipe/snipe-it Packagist
  • Medium 5.4
    CVE-2022-37251

    Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts

    Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.

    craftcms/cms Packagist
  • Medium 5.4
    CVE-2022-37247

    Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page

    Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.

    craftcms/cms Packagist
  • Medium 5.4
    CVE-2022-37248

    Craft CMS Cross site Scripting vulnerability

    Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.

    craftcms/cms Packagist
  • Medium 5.4
    CVE-2022-37250

    Craft CMS Stored Cross-site Scripting in User Addresses Title

    Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.

    craftcms/cms Packagist
  • Medium 5.8
    CVE-2022-3211

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.1
    GHSA-gqqf-g5r7-84vf

    TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection

    > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) ### Problem Due to a parsing issue in upstream package [`masterminds/html5`](https://packagist.org/packages/masterminds/html5), malicious markup used in a sequence with sp…

    typo3/cms-core Packagist
  • Medium 6.1
    CVE-2022-38796

    Feehi CMS host header injection vulnerability

    A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.

    feehi/cms Packagist
  • Medium 5.4
    CVE-2018-25047

    Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto

    In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.

    smarty3 smarty/smarty smarty3 smarty4 Debian Ubuntu Packagist
  • Medium 6.5
    CVE-2022-40734 Scanner template

    UniSharp Laravel Filemanager directory traversal vulnerability

    UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022. This is related to league/flysystem before 2.0.0.

    unisharp/laravel-filemanager Packagist
  • Medium 5.4
    CVE-2021-36568

    Moodle Cross-site Scripting vulnerability

    In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS…

    moodle/moodle moodle Ubuntu Packagist
  • Medium 5.3
    CVE-2022-36105

    User Enumeration via Response Timing in TYPO3

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user…

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 5.4
    CVE-2022-36106

    Missing check for expiration time of password reset token in TYPO3

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be …

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 6.5
    CVE-2022-36107

    Stored Cross-Site Scripting via FileDumpController

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this…

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 5.9
    CVE-2022-36104

    Denial of Service via Page Error Handling in TYPO3/cms

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error m…

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 6.5
    CVE-2022-36108

    Cross-Site Scripting in typo3/cms-core

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 vers…

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 6.1
    CVE-2022-36020

    Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer

    The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a se…

    TYPO3 HTML Sanitizer typo3/cms typo3/cms-core Packagist
  • Medium 6.3
    CVE-2022-36102

    Acess control list bypassed via crafted specific URLs

    Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update t…

    shopware shopware shopware/shopware Packagist
  • Medium 5.4
    CVE-2022-36101

    Sensitive data in backend customer module

    Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version …

    shopware shopware shopware/shopware Packagist
  • Medium 6.8
    CVE-2022-36376

    WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.

    Rank Math Rank Math SEO (WordPress plugin) rankmath/seo-by-rank-math Web / CMS Packagist
  • Medium 5.3
    CVE-2022-36032

    ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent

    ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. Th…

    reactphp http react/http icingaweb2-module-reactbundle Ubuntu Packagist
  • Medium 4.3
    CVE-2022-35933

    PrestaShop module Product Comments vulnerable to cross-site scripting (XSS)

    This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.

    PrestaShop productcomments prestashop/productcomments Packagist
  • Medium 6.1
    CVE-2022-36745

    LibreNMS vulnerable to Cross-Site Scripting (XSS)

    LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php.

    librenms/librenms Packagist
  • Medium 6.1
    CVE-2022-36746

    LibreNMS vulnerable to Cross-Site Scripting (XSS)

    LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.

    librenms/librenms Packagist
  • Medium 5.9
    CVE-2022-3035

    Cross-site Scripting (XSS) - Stored in snipe/snipe-it

    Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.

    snipe snipe/snipe-it snipe/snipe-it Packagist
  • Medium 5.9
    CVE-2022-36037

    Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby

    kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session…

    getkirby kirby getkirby/cms Packagist
  • Medium 4.8
    CVE-2022-37059

    Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel

    Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field

    intelliants/subrion Packagist