Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
High 8.1
Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
High 8.1
Command Injection in thorsten/phpmyfaq
Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
High 7.6
Uncaught Exception in thorsten/phpmyfaq
Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
High 7.1
Weak Password Requirements in thorsten/phpmyfaq
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
High 8.1
Code Injection in thorsten/phpmyfaq
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
High 8.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
High 8.4
Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
Medium 6.5
Code Injection in thorsten/phpmyfaq
Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
High 8.3
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
Medium 4.0
Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
-
Medium 6.3
webbuilders-group silverstripe-kapost-bridge KapostService.php getPreview sql injection
A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql inject…
-
Medium 4.8
Formwork Cross-site Scripting (XSS) from Page title field
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter.
-
Medium 5.3
Privilege Chaining in cockpit-hq/cockpit
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
-
Critical 9.8
Deserialization of Untrusted Data in thinkphp
thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
-
High 8.8
Persisted Cross-Site Scripting in Frontend Rendering in typo3
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows …
-
Critical 10.0
URI validation failure on SVG parsing. Bypass of CVE-2023-23924
Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of `image` tags and respects `xlin…
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in wallabag/wallabag
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
-
Medium 4.6
Cross-site Scripting (XSS) - Stored in wallabag/wallabag
Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
-
Low 3.5
tinymighty WikiSEO Meta Property Tag WikiSEO.body.php modifyHTML cross site scripting
A vulnerability, which was classified as problematic, was found in tinymighty WikiSEO 1.2.1 on MediaWiki. This affects the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content le…
-
Low 2.6
DaSchTour matomo-mediawiki-extension Username Piwik.hooks.php cross site scripting
A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripti…
-
Low 3.5CVE-2018-25080 Public exploit
MobileDetect Example session_example.php initLayoutType cross site scripting
A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the function initLayoutType of the file examples/session_example.php of the component Example. The manipulation of the argument $_SERVER['PHP_SELF'…
-
Critical 9.9
Code Injection in froxlor/froxlor
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 5.9CVE-2022-24894 Public exploit
Symfony storing cookie headers in HttpCache
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the…
-
Medium 6.3
Symfony vulnerable to Session Fixation of CSRF tokens
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSR…
-
High 7.5
SwagPayPal payment not sent to PayPal correctly
SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one i…
-
High 8.2
Missing file upload type validation in pimcore/pimcore
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass thi…
-
Medium 5.4
Cross site scripting in automad/automad
Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.
-
High 8.6
Broken Access Control in 3rd party TYPO3 extension "femanager"
An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users.
-
High 8.6
Broken Access Control in 3rd party TYPO3 extension "femanager"
An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users.
-
Unscored —
The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. Previou…
-
Medium 6.5
Improper Authorization in wallabag/wallabag
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
-
Medium 6.3
Cross-site Scripting (XSS) - DOM in microweber/microweber
Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
-
Medium 5.4
Improper Authorization in wallabag/wallabag
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
-
Critical 10.0CVE-2023-23924 Public exploit
URI validation failure on SVG parsing in Dompdf
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can e…
-
Low 2.0
mosbth cimage check_system.php cross site scripting
A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross …
-
Medium 5.3
Unchecked Error Condition in froxlor/froxlor
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 6.2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.
-
Medium 5.5
Business Logic Errors in froxlor/froxlor
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 5.4
Weak Password Requirements in froxlor/froxlor
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
-
Medium 4.9
OpenMage LTS has DoS vulnerability in MaliciousCode filter
OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.