Skip to content
OpenAdvisories

Ecosystem

Packagist

7,192 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

3,767 results · Clear filters · Feed

  • Medium 6.1
    CVE-2007-3498

    HTML Purifier Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in smoketests/configForm.php in HTML Purifier before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "unescaped print_r output."

    ezyang/htmlpurifier Packagist
  • Medium —
    CVE-2006-5734

    PHPMailer Local file inclusion

    Multiple PHP remote file inclusion vulnerabilities in ATutor 1.5.3.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) section parameter in (a) documentation/common/frame_toc.php and (b) documentation/common/search.php, the (2) req_lan…

    phpmailer/phpmailer Packagist
  • Medium —
    CVE-2006-5031 Public exploit

    CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files

    Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js …

    cakephp/cakephp cakephp Debian Packagist
  • Medium —
    CVE-2006-4936

    Moodle does not properly validate module instance id

    Moodle before 1.6.2 does not properly validate the module instance id when creating a course module object, which has unspecified impact and remote attack vectors.

    moodle/moodle Packagist
  • Medium 6.5
    CVE-2006-4067

    Cross-site scripting (XSS) vulnerability in CakePHP

    Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. NOTE: some of these details are…

    cakephp/cakephp cakephp Debian Packagist
  • Medium —
    CVE-2006-3360

    phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence

    Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error mess…

    phpsysinfo phpsysinfo/phpsysinfo Debian Packagist
  • Medium —
    CVE-2005-3621

    phpMyAdmin CRLF Injection Vulnerability

    CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts.

    phpmyadmin phpmyadmin/phpmyadmin Debian Packagist