Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
Medium 6.1
Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workarou…
-
High 7.5
silverstripe/graphql Denial of Service vulnerability
`silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpo…
-
Medium 4.0
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
The Media Responsive Thumbnail module allows media reference fields to be rendered as a responsive image. This module d…
-
Unscored —
Drupal core provides a page that outputs the markup from `phpinfo()` to assist with diagnosing PHP configuration. If an…
-
Unscored —
The language module provides a Language switcher block which can be placed to provide links to quickly switch between d…
-
Unscored —
The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnail…
-
High 7.5
CodeIgniter Shield Password Shucking Vulnerability
CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than exp…
-
Medium 5.0
PrestaShop has possible CSRF token fixation
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, t…
-
Medium 6.0
Code Injection in alextselegidis/easyappointments
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Low 3.7
Timing attack in eZ Platform Ibexa
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
-
High 7.2
Company admin role gives excessive privileges in eZ Platform Ibexa
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
-
Critical 9.8
Object state limitation has no effect
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
-
Medium 6.1
Cross-site scripting in eZ Platform Kernel
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
-
Medium 5.3
/user/sessions endpoint allows detecting valid accounts
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.
-
Medium 6.6
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarum
flarum is a forum software package for building communities. In versions prior to 1.7.0 an admin account which has already been compromised by an attacker may use a vulnerability in the `LESS` parser which can be exploited to read sensitive files on the serve…
-
Critical 9.8
Authentication Bypass by Primary Weakness in froxlor/froxlor
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
-
High 7.2
Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.
-
Medium 5.2
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
-
Critical 9.8
Funadmin vulnerable to SQL injection
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.
-
Medium 4.8
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
-
Unscored —
This module provides a new UI experience for node editing - Gutenberg editor. This vulnerability can cause DoS by using…
-
Medium 6.5
Use of Hard-coded Credentials in alextselegidis/easyappointments
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.
-
Critical 9.8
SQL Injection in Funadmin
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.
-
Medium 4.3
Cross-site Scripting (XSS) - Stored in uvdesk/community-skeleton
Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.
-
Critical 9.8
Remote code execution in Funadmin
Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.
-
Medium 5.3
Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
-
Critical 9.8CVE-2021-36394 Public exploit
Moodle Session Fixation vulnerability
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
-
Medium 4.8
Moodle vulnerable to Stored Cross-site Scripting
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.
-
Critical 9.8
Moodle SQL Injection vulnerability
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.
-
Medium 5.3
Moodle Improper Input Validation vulnerability
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.
-
Medium 5.3
Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
-
Critical 9.8
Moodle SQL Injection vulnerability
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.
-
Medium 5.4
Moodle Cross-site Scripting vulnerability
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.