Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
3,767 results · Clear filters · Feed
-
Medium 6.3
Moodle Users could elevate their role when accessing the LTI tool on a provider site
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
-
Medium 4.3
Moodle Logged in users could view all calendar events
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar event…
-
Medium 6.5
Moodle Blind SSRF Risk in /badges/mybackpack.php
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind…
-
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note tha…
-
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is …
-
Medium 6.1
Moderate severity vulnerability that affects league/commonmark
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerabilit…
-
Medium 6.1
Microweber XSS Vulnerability
Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.
-
Medium 6.1
Dolibarr Stored Cross-site Scripting in expensereport/card.php
An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note.
-
Medium 6.1
Bootstrap Vulnerable to Cross-Site Scripting
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
-
Medium 6.1
MODX Revolution allows XSS through extended user fields
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.
-
Medium 5.4
MODX vulnerability allows for XSS via user settings parameters
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.
-
Medium 6.1
MODX Revolution vulnerable to XSS attack through its User Photo field
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
-
Medium 6.1
MODX Revolution allows XSS via document resources
MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.
-
Medium 6.5
Incorrect Access Control vulnerability in api-platform/core
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must …
-
Medium 4.8
Croogo vulnerable to XSS in title field
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies.
-
Medium 4.8
Croogo vulnerable to Cross-site Scripting in title field
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4.
-
Medium 4.8
Croogo vulnerable to XSS in Blog field
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog.
-
Medium 4.8
Croogo vulnerable to XSS in title field
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8.
-
Medium 4.8
Croogo vulnerable to XSS in title field
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/edit/3.
-
Medium 5.9
Yii Incorrectly Implements CORS
Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
-
Medium 5.9
phpMyAdmin Arbitrary file read vulnerability
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to…
-
Medium 6.5
Access bypass in Drupal 8 views
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated …
-
Medium 6.5
Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than al…
-
Medium 5.9
File REST resource does not properly validate
In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PAT…
-
Medium 6.5
Shopware XXE Vulnerability
Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.
-
Medium 5.9
Sensitive Data Exposure in elFinder
php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.
-
Medium 5.4
Fork CMS XSS Vulnerability
Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).
-
Medium 6.1
EC-CUBE Open redirect vulnerability
Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC…
-
Medium 6.1
XSS vulnerability that affects bootstrap
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
-
Medium 6.1
bootstrap Cross-site Scripting vulnerability
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
-
Medium 6.1CVE-2016-10735 Public exploit
Bootstrap Cross-site Scripting vulnerability
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
-
Medium 6.1
Dolibarr reflected cross-site scripting (XSS) vulnerability
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php.
-
Medium 5.4
Dolibarr stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to user/card.php.
-
Medium 5.4
Dolibarr stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to adherents/type.php.
-
Medium 6.1
PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing jav…
-
Medium 4.8
Kirby XSS Vulnerability
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.
-
Medium 5.4
Evolution CMS Stored Cross-site Scripting (XSS)
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.
-
Medium 5.4
Evolution CMS Cross-site Scripting (XSS)
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
-
Medium 6.1CVE-2018-19799 Public exploit
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.
-
Medium 4.8CVE-2018-20418 Public exploit
Craft CMS Cross-site Scripting (XSS) Vulnerability
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.