Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
3,767 results · Clear filters · Feed
-
Medium 6.1
Craft CMS XSS Vulnerability
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
-
Medium 4.8
z-song laravel-admin XSS via the Slug or Name on the Roles screen
z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen.
-
Medium 6.5
Centreon Sensitive Data Exposure
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.
-
Medium 5.4
TeamPass Stored Cross-site Scripting
TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.
-
Medium 5.4
TeamPass Stored Cross-site Scripting
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.
-
Medium 6.1
TeamPass Stored Cross-site Scripting
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
-
Medium 5.4
Dolibarr stored Cross-site Scripting in an Email Template section
Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)
-
Medium 5.4
Dolibarr Cross-site Scripting in a User Profile in a Signature section
Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
-
Medium 5.4
Dolibarr Cross-site Scripting in a User Note section
Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.
-
Medium 5.4
Dolibarr stored Cross-site Scripting vulnerability
Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
-
Medium 6.5
phpBB Cross-Site Request Forgery (CSRF)
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
-
Medium 5.3
SilverStripe Versioned Files module Unpublished files are exposed publicly
In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles so…
-
Medium 5.4
SilverStripe asset-admin Cross-site Scripting (XSS)
In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.
-
Medium 5.3
Broken access control on files
In SilverStripe assets 4.0, there is broken access control on files.
-
Medium 5.4
TeamPass Cross-site Scripting (XSS) vulnerability
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. (The crafted password is exploitable when viewing the change history of the item or tapping on the item.)
-
Medium 5.3
MediaWiki information disclosure
In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.
-
Medium 6.1
Silverstripe Flash Clipboard Reflected XSS
SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.
-
Medium 6.3
Session fixation in change password form
SilverStripe through 4.3.3 allows session fixation in the "change password" form.
-
Medium 5.3
Lack of access control on upoaded files
SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
-
Medium 6.1
Joomla! XSS in Default Templates
In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.
-
Medium 5.3
Pagekit User enumeration
The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts.
-
Medium 6.1
XSS vulnerability in company name field in Mautic
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
-
Medium 6.1CVE-2019-16197 Public exploit
Cross-site scripting in Dolibarr
In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.
-
Medium 6.5
phpMyAdmin Cross-Site Request Forgery (CSRF)
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
-
Medium 5.4CVE-2019-16172 Public exploit
Cross-site Scripting in LimeSurvey
LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.
-
Medium 5.4CVE-2019-16173 Public exploit
Cross-site Scripting in LimeSurvey
LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS
An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths.
-
Medium 6.1
Cross-site Scripting in YII2-CMS
YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
-
Medium 6.1
Cross-site Scripting in Grav
Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.
-
Medium 6.1
XSS vulnerability in Author URL of themes in Mautic
An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json.
-
Medium 6.1
Cosenary Instagram-PHP-API contains reflected XSS vulnerability
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
-
Medium 6.1
laracom Cross-site Scripting
laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.
-
Medium 6.1
Cross-site Scripting in Bolt
Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.
-
Medium 6.1
Bolt Cross-site Scripting (XSS) via an image's alt or title field
Bolt before 3.6.10 has XSS via an image's alt or title field.
-
Medium 6.1
Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log
Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.
-
Medium 6.1
Kimai v2 is vulnerable to Cross-Site Scripting (XSS)
Kimai v2 before 1.1 has XSS via a timesheet description.
-
Medium —
MantisBT allows cross-site scripting (XSS) via crafted filename
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is exec…
-
Medium 6.1
Backpack\CRUD for Laravel XSS Vulnerability
The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.
-
Medium 5.4
TeamPass Cross-site Scripting (XSS)
An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload.
-
Medium 4.8
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the tax notifications configuration in the Magento a…