Ecosystem
Packagist
7,191 known vulnerabilities.
Most affected packages
3,767 results · Clear filters · Feed
-
Medium 4.3
DayByDay CRM - Missing Authorization when Viewing Absences
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not…
-
Medium 4.3
DayByDay CRM - Missing Authorization when Viewing Appointments
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type o…
-
Medium 6.9
XSS vulnerability in oro/platform
OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, exe…
-
Medium 5.3
Generation of Error Message Containing Sensitive Information in star7th/showdoc
showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
-
Medium 5.4
Cross site scripting in dolibarr
admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.
-
Medium 6.1
Cross-site Scripting in Netgen Tags Bundle
Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface.
-
Medium 6.3
Cross-Site Request Forgery (CSRF) in star7th/showdoc
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja
invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.1
PrestaShop XSS Vulnerability
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.7
Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager
This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: 1. Install a package with a web Larave…
-
Medium 6.1
Wechat-php-sdk is affected by a Cross Site Scripting vulnerability.
Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php.
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.4
Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.1
Cross-site Scripting in Anchor CMS
Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving ot…
-
Medium 5.3CVE-2021-4119 EPSS 27%
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.4
Dolibarr Cross Site Scripting (XSS) vulnerability
A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box.
-
Medium 6.4
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.3
Cross-site Scripting (XSS) - Reflected in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.3
CRLF Injection in phpservermon/phpservermon
phpservermon is vulnerable to Improper Neutralization of CRLF Sequences
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrm
yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Improper Access Control in snipe/snipe-it
snipe-it is vulnerable to Improper Access Control
-
Medium 5.5
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in pimcore/pimcore
pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.1
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.3
Blade `@parent` Exploitation Leading To Possible XSS in Laravel
Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another locati…
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 5.3
Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg
elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
-
Medium 6.5
Open Redirect in star7th/showdoc
showdoc is vulnerable to URL Redirection to Untrusted Site
-
Medium —
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be …
-
Medium —
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be …
-
Medium 6.1
Cross-site Scripting in LibreNMS
Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.
-
Medium 6.1
Cross-site Scripting in LibreNMS
Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.
-
Medium 4.3
Authorization Bypass Through User-Controlled Key in elgg/elgg
elgg is vulnerable to Authorization Bypass Through User-Controlled Key
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')