Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
3,767 results · Clear filters · Feed
-
Medium 5.9
Symfony CSRF Vulnerability
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM…
-
Medium 6.1
MantisBT allows XSS via View Filters page
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO.
-
Medium 6.1
MantisBT allows XSS on the Edit Filter page via crafted filter name
An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted na…
-
Medium 6.5CVE-2018-14773 EPSS 58%
Symfony HTTP Foundation web cache poisoning
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users overr…
-
Medium 5.4
paypal/invoice-sdk-php reflected XSS
paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.
-
Medium 5.4
paypal/permissions-sdk-php reflected Cross-site Scripting (XSS)
paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution.
-
Medium 6.1CVE-2018-14840 Public exploit
Subrion CMS Cross-site Scripting
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
-
Medium 5.4
Subrion CMS XSS
Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.
-
Medium 5.4
Gleez Cms Cross-site Scripting in Profile Page
Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in Inject arbitrary web script or HTML via the profile page editor. This attack appear to be exploitable via The victim must navigate to the a…
-
Medium 6.1
Pagekit open redirect vulnerability
Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.
-
Medium 6.1CVE-2018-14042 Public exploit
Bootstrap Cross-site Scripting vulnerability
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
-
Medium 6.1CVE-2018-14041 Public exploit
Bootstrap Cross-site Scripting vulnerability
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
-
Medium 6.1CVE-2018-14040 Public exploit
Bootstrap vulnerable to Cross-Site Scripting (XSS)
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
-
Medium 6.3
Moodle XSS Vulnerability
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.
-
Medium 4.3
Moodle Exposure of Sensitive Information to an Unauthorized Actor
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.
-
Medium 4.3
Moodle sensitive information disclosure
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.
-
Medium 5.3
Sensitive Data Exposure in baserCMS
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors.
-
Medium 5.4
XSS in baserCMS
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Medium 6.1
XSS in baserCMS
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Medium 5.3
baserCMS Access Control Bypass
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.
-
Medium 4.3
baserCMS arbitrary file upload vulnerability
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
-
Medium 6.1
phpMyAdmin XSS Vulnerability
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer featur…
-
Medium 5.9
Symfony DoS
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some…
-
Medium 6.1
Symfony Open Redirect
The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. N…
-
Medium 6.1
Symfony Open Redirect
An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates…
-
Medium 6.1
Yii2-StateMachine extension for Yii2 XSS Vulnerability
The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.
-
Medium 5.4
nZEDb Cross-site Scripting (XSS) in the 404 error page
nZEDb v0.7.3.3 has XSS in the 404 error page.
-
Medium 4.8CVE-2018-11564 Public exploit
Pagekit Stored Cross-site Scripting
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will …
-
Medium 4.9
OpenCart Path Traversal
OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the download_id. For example, an attacker can download ../../config.php.
-
Medium 4.3
Moodle Cross-site Scripting
An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerabil…
-
Medium 6.5
Moodle Portfolio forum caller class allows a user to download any file
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.
-
Medium 6.5
Moodle Improper Privilege Management
An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.
-
Medium 6.1
Dolibarr Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
-
Medium 4.8
Joomla! XSS Vulnerability
An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attac…
-
Medium 4.8
GeniXCMS Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding a menu.
-
Medium 6.1CVE-2018-10366 Public exploit
User Plugin for October CSS Allows XSS
An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
-
Medium 6.1
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)
Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject a…
-
Medium 6.1
Cross-site Scripting in Parsedown
Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to s…
-
Medium 6.1
XSS vulnerability in theme config file in Mautic
Mautic before v2.13.0 has stored XSS via a theme config file.
-
Medium 5.4
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.