Skip to content
OpenAdvisories

Ecosystem

Packagist

7,192 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,182 results · Feed

  • Critical 9.1
    CVE-2022-45152

    Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library

    A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind …

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2022-41705

    Badaso vulnerable to Remote Code Execution (RCE)

    Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.

    badaso/core Packagist
  • High 8.2
    CVE-2022-41706

    Browsershot 3.57.2 - Server Side XSS to LFR via URL

    Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.

    spatie/browsershot Packagist
  • Critical 9.0
    CVE-2022-37721

    PyroCMS vulnerable to stored Cross Site Scripting

    PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.

    pyrocms/pyrocms Packagist
  • High 8.2
    CVE-2022-43984

    Browsershot 3.57.3 - Server Side XSS to LFR via HTML

    Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not co…

    spatie/browsershot Packagist
  • High 8.2
    CVE-2022-43983

    Browsershot 3.57.2 - Server Side XSS to LFR via HTML

    Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:/…

    spatie/browsershot Packagist
  • Medium 5.4
    CVE-2022-38147

    XSS via uploaded gpx file

    Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).

    silverstripe/assets Packagist
  • Medium 5.4
    CVE-2022-38145

    Stored XSS in Compare Mode

    Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view.

    silverstripe/versioned-admin Packagist
  • Medium 5.4
    CVE-2022-45151

    Moodle stored-XSS vulnerability in some "social" user profile fields

    The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2022-45149

    Cross-Site Request Forgery in Moodle

    A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote at…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2022-45150

    Moodle reflected cross-site scripting vulnerability in policy tool

    A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML …

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 8.1
    CVE-2022-41922

    yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input

    `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.

    yiisoft yii yiisoft/yii Packagist
  • Medium 4.8
    CVE-2022-42095 Public exploit Scanner template

    Cross-site Scripting in Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.

    backdrop/backdrop Packagist
  • Medium 5.4
    CVE-2022-37421

    Silverstipe CMS Stored XSS in custom meta tags

    Silverstripe silverstripe/cms through 4.11.0 allows XSS.

    silverstripe/cms Packagist
  • Medium 5.4
    CVE-2022-37430

    Stored XSS using uppercase characters in HTMLEditor

    Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).

    silverstripe/framework Packagist
  • Medium 5.4
    CVE-2022-37429

    Stored XSS using HTMLEditor

    Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.

    silverstripe/framework Packagist
  • High 8.8
    CVE-2022-33012

    Account Takeover Through Password Reset Poisoning

    Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.

    microweber/microweber Packagist
  • Medium 5.4
    CVE-2022-38724

    Silverstripe XSS in shortcodes

    Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS.

    silverstripe/framework silverstripe/assets Packagist
  • Medium 6.1
    CVE-2022-38462

    Reflected XSS in querystring parameters

    Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request.

    silverstripe/framework Packagist
  • Medium 4.8
    CVE-2022-42097 Public exploit

    Cross-site Scripting in Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .

    backdrop/backdrop Packagist
  • Medium 4.8
    CVE-2022-42094 Public exploit Scanner template

    Cross-site Scripting in Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.

    backdrop/backdrop Packagist
  • High 8.1
    CVE-2022-4093

    SQL Injection in dolibarr/dolibarr

    SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputati…

    Dolibarr dolibarr/dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2022-38146

    URL XSS vulnerability due to outdated jquery in CMS

    Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3).

    silverstripe/admin Packagist
  • High 8.8
    CVE-2022-38148

    Blind SQL Injection via GridFieldSortableHeader

    Silverstripe silverstripe/framework through 4.11 allows SQL Injection.

    silverstripe/framework Packagist
  • Medium 4.8
    CVE-2022-42096 Public exploit Scanner template

    Cross-site Scripting in Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.

    backdrop/backdrop Packagist
  • Low 2.7
    CVE-2022-4070

    Insufficient Session Expiration in librenms/librenms

    Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Low 3.4
    CVE-2022-4069 EPSS 93%

    Cross-site Scripting (XSS) - Generic in librenms/librenms

    Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.

    librenms librenms/librenms librenms/librenms Packagist
  • High 7.6
    CVE-2022-4068 EPSS 38%

    Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms

    A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low p…

    librenms librenms/librenms librenms/librenms Packagist
  • Low 3.4
    CVE-2022-4067 EPSS 94%

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Medium 4.3
    CVE-2022-3562 EPSS 94%

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Medium 5.7
    CVE-2022-3516

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Medium 4.3
    CVE-2022-3561

    Cross-site Scripting (XSS) - Generic in librenms/librenms

    Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Critical 9.0
    CVE-2022-3525

    Deserialization of Untrusted Data in librenms/librenms

    Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Critical 9.0
    CVE-2022-41938

    Cross site scripting vulnerability with discussion titles in flarum

    Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed. This allowed an attacker to inject malicious H…

    flarum framework flarum/core Packagist
  • Critical 9.8
    CVE-2022-43138

    Dolibarr vulnerable to privilege escalation

    Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 4.3
    CVE-2022-4014

    FeehiCMS Post My Comment Tab cross-site request forgery

    A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My Comment Tab. The manipulation leads to cross-site request forgery. The attack may be launched remot…

    feehi/feehicms Packagist
  • Medium 5.4
    CVE-2022-44071

    Cross-site Scripting in Zenario

    Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2022-44070

    Cross-site Scripting in Zenario

    Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2022-44073

    Cross-site Scripting in Zenario

    Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2022-44069

    Cross-site Scripting in Zenario

    Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.

    tribalsystems/zenario Packagist