Ecosystem
Packagist
7,191 known vulnerabilities.
Most affected packages
3,767 results · Clear filters · Feed
-
Medium 4.0
SQL injection in TYPO3 extension
The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.
-
Medium 6.8
CSRF token exposure in TYPO3 extension
The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.
-
Medium —
Cross-site Scripting in the femanager TYPO3 extension
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
-
Medium 5.4
Cross-site Scripting in the yoast_seo TYPO3 extension
The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.
-
Medium 5.4CVE-2021-37704 Scanner template
Exposed phpinfo() in PhpFastCache
PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation tod…
-
Medium 5.9
Cross site scripting via HTML attributes in the back end
Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.
-
Medium 6.1
Cross-Site Scripting via Rich-Text Content
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to…
-
Medium 4.3
Improper Access Control in “Dolibarr”
In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/…
-
Medium 6.1
Subrion Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.
-
Medium 5.4
Cross Site Scripting in Subrion CMS
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
-
Medium 5.4
Akaunting Password Reset Relay
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in …
-
Medium 5.3
Missing Cryptographic Step in star7th/showdoc
showdoc is vulnerable to Missing Cryptographic Step
-
Medium 6.1
NukeViet Cross-site Scripting via the editor in the News module
Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.
-
Medium 4.8
Cross Site Scripting in LavaLite CMS
Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
-
Medium 5.3
Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii
firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
-
Medium 5.3
Information Disclosure in User Authentication
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is n…
-
Medium 6.4
Cross-Site Scripting in Backend Grid View
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for _backend layouts_ are not properly encoded, the corr…
-
Medium 6.4
Cross-Site Scripting in Query Generator & Query View
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGen…
-
Medium 6.4
Cross-Site Scripting in Page Preview
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding …
-
Medium 5.4CVE-2021-28114 EPSS 52%
Cross-site Scripting in Froala WYSIWYG Editor
Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.
-
Medium 6.5
ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability
Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.
-
Medium 4.8
Cross-site scripting in LavaLite-CMS
Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.
-
Medium 5.4
LavaLite Stored Cross-site Scripting vulnerability
A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
-
Medium 5.4
Stored XSS in LavaLite 5.8.0
A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
-
Medium 5.4
Stored XSS in LavaLite 5.8.0
A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
-
Medium 6.1
Craft CMS Cross-site Scripting Vulnerability
An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
-
Medium 5.3
List of order ids, number, items total and token value exposed for unauthorized uses via new API
Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploit…
-
Medium —
non-admin users can create integration role with administrator role
### Impact non-admin users can create integration role with administrator role ### Patches We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. https://ww…
-
Medium —
Canceling of orders not related to the logged-in user
### Impact Canceling of orders not related to the logged-in user ### Patches We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com…
-
Medium 5.4
Magento Commerce path traversal vulnerability in child theme store creation
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated…
-
Medium 5.3
Magento Commerce improper input validation in customer customer webapi
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails.
-
Medium 6.5
Magento Commerce improper Authorization via the 'Create Customer' endpoint
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer dat…
-
Medium 6.9
Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthe…
-
Medium 6.1
EC-CUBE Cross-site scripting vulnerability
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.
-
Medium 6.1
EC-CUBE Cross-site scripting vulnerability
Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted pa…
-
Medium 4.4
Internal hidden fields are visible on to many associations in admin api
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the u…
-
Medium 5.3
Information leakage in Error Handler
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directl…
-
Medium 4.8
Authenticated Stored XSS
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updat…
-
Medium 5.9
Potential Session Hijacking in Shopware
Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via th…
-
Medium 4.9
Creation of order credits was not validated by acl in admin orders
Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via t…