Skip to content
OpenAdvisories

Ecosystem

Packagist

7,191 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

3,767 results · Clear filters · Feed

  • Medium 6.4
    CVE-2022-0966

    Stored XSS via File Upload in star7th/showdoc in star7th/showdoc

    Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.9
    CVE-2022-0967 Public exploit

    Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc

    Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 5.7
    CVE-2022-0963 Scanner template

    Unrestricted XML Files Leads to Stored XSS in microweber/microweber

    Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.8
    CVE-2022-0954 Scanner template

    Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in microweber/microweber

    Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.8
    CVE-2022-0893

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.5
    CVE-2022-0950

    Unrestricted Upload of File with Dangerous Type in star7th/showdoc

    Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.1
    CVE-2022-24749

    Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius

    Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open…

    Sylius Sylius sylius/sylius Packagist
  • Medium 5.0
    CVE-2022-24742

    Exposure of Sensitive Information Due to Incompatible Policies in Sylius

    Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. …

    Sylius Sylius sylius/sylius Packagist
  • Medium 6.1
    CVE-2022-24733

    Improper Restriction of Rendered UI Layers or Frames in Sylius

    Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays…

    Sylius Sylius sylius/sylius Packagist
  • Medium 4.8
    CVE-2021-41952

    Cross-site Scripting in Zenario CMS

    Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.

    tribalsystems/zenario Packagist
  • Medium 6.3
    CVE-2022-0940

    Stored XSS due to Unrestricted File Upload in star7th/showdoc

    Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.3
    CVE-2022-0937

    Stored xss in showdoc through file upload in star7th/showdoc

    Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.8
    CVE-2022-0929

    XSS on dynamic_text module in microweber/microweber

    XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 5.3
    CVE-2021-32473

    Moodle Information Disclosure vulnerability

    It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2021-32475

    Moodle stored Cross-site Scripting

    ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2021-32477

    Moodle Exposure of Sensitive Information to an Unauthorized Actor

    The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.8
    CVE-2022-0928 Scanner template

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 4.8
    CVE-2022-0912

    Unrestricted Upload of File with Dangerous Type in microweber/microweber

    Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.1
    CVE-2021-32478 Scanner template

    Moodle reflected XSS

    The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2021-32472

    Moodle Exposure of Sensitive Information to an Unauthorized Actor

    Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and 3.8 to 3.8.8 are affected.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2022-0906

    Unrestricted file upload leads to stored XSS in microweber/microweber

    Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 4.8
    CVE-2022-24745

    Guest session is shared between customers in shopware

    Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. …

    shopware platform shopware/platform shopware/storefront Packagist
  • Medium 6.1
    CVE-2022-24746

    HTML injection possibility in voucher code form

    Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workaro…

    shopware platform shopware/platform shopware/core Packagist
  • Medium 6.3
    CVE-2022-24747

    HTTP caching is marking private HTTP headers as public

    Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client the…

    shopware platform shopware/platform shopware/core Packagist
  • Medium 6.8
    CVE-2022-24748

    Incorrect Authentication in shopware

    Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api rout…

    shopware platform shopware/core Packagist
  • Medium 5.3
    CVE-2022-0813

    PhpMyAdmin exposure of sensitive information

    PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.

    phpMyAdmin phpMyAdmin phpmyadmin phpmyadmin Debian Ubuntu Packagist
  • Medium 6.1
    CVE-2020-18325 Public exploit

    Cross-site Scripting in intelliants/subrion

    Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.

    intelliants/subrion Packagist
  • Medium 6.1
    CVE-2020-18324 Public exploit

    Cross-site Scripting in Subrion CMS

    Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.

    intelliants/subrion Packagist
  • Medium 4.6
    CVE-2022-0832 EPSS 67%

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 4.6
    CVE-2022-0831

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.4
    CVE-2022-24563

    Cross-site Scripting in GeniXCMS

    In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.

    genix/cms Packagist
  • Medium 5.4
    CVE-2022-26332

    Cross-site Scripting in Cipi

    Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.

    andreapollastri/cipi Packagist
  • Medium 4.6
    CVE-2022-0743

    Cross-site Scripting (XSS) - Stored in getgrav/grav

    Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.

    getgrav getgrav/grav getgrav/grav Packagist
  • Medium 6.3
    CVE-2022-24712

    Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4

    CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to v…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • Medium 4.7
    CVE-2022-0772

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2.

    librenms librenms/librenms librenms/librenms Packagist
  • Medium 4.3
    CVE-2022-0763

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 5.5
    CVE-2022-0762

    Incorrect Authorization in microweber/microweber

    Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 4.3
    CVE-2022-0746

    Business Logic Errors in dolibarr/dolibarr

    Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.

    Dolibarr dolibarr/dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.3
    CVE-2022-25355

    EC-CUBE improperly handles HTTP Host header values

    EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE use…

    EC-CUBE EC-CUBE 3 series and EC-CUBE 4 series ec-cube/ec-cube Packagist
  • Medium 4.8
    CVE-2022-23655

    Missing server signature validation in OctoberCMS

    Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advis…

    October CMS october october/system Packagist