Skip to content
OpenAdvisories

Ecosystem

Packagist

7,192 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,182 results · Feed

  • Medium 5.4
    CVE-2022-3005

    Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

    yetiforcecompany yetiforcecompany/yetiforcecrm yetiforce/yetiforce-crm Packagist
  • Medium 4.3
    CVE-2022-3242 Scanner template

    HTML code Injection in template search keyword in microweber/microweber

    Code Injection in GitHub repository microweber/microweber prior to 1.3.2.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.3
    CVE-2022-3004

    Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

    yetiforcecompany yetiforcecompany/yetiforcecrm yetiforce/yetiforce-crm Packagist
  • Medium 6.3
    CVE-2022-3000

    Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

    yetiforcecompany yetiforcecompany/yetiforcecrm yetiforce/yetiforce-crm Packagist
  • High 7.1
    CVE-2022-2924

    Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.

    yetiforcecompany yetiforcecompany/yetiforcecrm yetiforce/yetiforce-crm Packagist
  • Medium 5.6
    CVE-2022-3231

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Medium 4.3
    CVE-2022-3173

    Improper Authentication in snipe/snipe-it

    Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.

    snipe snipe/snipe-it snipe/snipe-it Packagist
  • Medium 5.4
    CVE-2022-37251

    Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts

    Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.

    craftcms/cms Packagist
  • Medium 5.4
    CVE-2022-37247

    Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page

    Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.

    craftcms/cms Packagist
  • Medium 5.4
    CVE-2022-37248

    Craft CMS Cross site Scripting vulnerability

    Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.

    craftcms/cms Packagist
  • Medium 5.4
    CVE-2022-37250

    Craft CMS Stored Cross-site Scripting in User Addresses Title

    Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.

    craftcms/cms Packagist
  • Medium 5.8
    CVE-2022-3211

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.1
    GHSA-gqqf-g5r7-84vf

    TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection

    > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) ### Problem Due to a parsing issue in upstream package [`masterminds/html5`](https://packagist.org/packages/masterminds/html5), malicious markup used in a sequence with sp…

    typo3/cms-core Packagist
  • Critical 9.8
    CVE-2022-38352 EPSS 22%

    ThinkPHP deserialization vulnerability

    ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

    topthink/framework Packagist
  • Medium 6.1
    CVE-2022-38796

    Feehi CMS host header injection vulnerability

    A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.

    feehi/cms Packagist
  • Medium 5.4
    CVE-2018-25047

    Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto

    In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.

    smarty3 smarty/smarty smarty3 smarty4 Debian Ubuntu Packagist
  • Medium 6.5
    CVE-2022-40734 Scanner template

    UniSharp Laravel Filemanager directory traversal vulnerability

    UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022. This is related to league/flysystem before 2.0.0.

    unisharp/laravel-filemanager Packagist
  • Medium 5.4
    CVE-2021-36568

    Moodle Cross-site Scripting vulnerability

    In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS…

    moodle/moodle moodle Ubuntu Packagist
  • Medium 5.3
    CVE-2022-36105

    User Enumeration via Response Timing in TYPO3

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user…

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 5.4
    CVE-2022-36106

    Missing check for expiration time of password reset token in TYPO3

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be …

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 6.5
    CVE-2022-36107

    Stored Cross-Site Scripting via FileDumpController

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this…

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 5.9
    CVE-2022-36104

    Denial of Service via Page Error Handling in TYPO3/cms

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error m…

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 6.5
    CVE-2022-36108

    Cross-Site Scripting in typo3/cms-core

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 vers…

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 6.1
    CVE-2022-36020

    Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer

    The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a se…

    TYPO3 HTML Sanitizer typo3/cms typo3/cms-core Packagist
  • Medium 6.3
    CVE-2022-36102

    Acess control list bypassed via crafted specific URLs

    Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update t…

    shopware shopware shopware/shopware Packagist
  • Medium 5.4
    CVE-2022-36101

    Sensitive data in backend customer module

    Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version …

    shopware shopware shopware/shopware Packagist
  • Medium 6.8
    CVE-2022-36376

    WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.

    Rank Math Rank Math SEO (WordPress plugin) rankmath/seo-by-rank-math Web / CMS Packagist
  • Critical 9.0
    CVE-2022-2925

    Cross-site Scripting (XSS) - Stored in appwrite/appwrite

    Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.

    appwrite appwrite/appwrite appwrite/server-ce Packagist
  • Unscored —
    DRUPAL-CONTRIB-2022-056

    This module enables you to set content permissions based on taxonomy terms. The module doesn't sufficiently restrict ac…

    drupal/permissions_by_term Packagist
  • Unscored —
    DRUPAL-CONTRIB-2022-055

    This module enables you to restrict content via taxonomy terms and related permissions. The module doesn't sufficiently…

    drupal/permissions_by_term Packagist
  • Unscored —
    DRUPAL-CONTRIB-2022-054

    The Next.js module provides an inline preview for content. Authenticated requests are made to Drupal to fetch JSON:API …

    drupal/next Packagist
  • Medium 5.3
    CVE-2022-36032

    ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent

    ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. Th…

    reactphp http react/http icingaweb2-module-reactbundle Ubuntu Packagist
  • Critical 9.8
    CVE-2020-21516

    FeehiCMS has an arbitrary file upload vulnerability

    There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code.

    feehi/cms Packagist
  • High 7.3
    CVE-2022-34867

    WordPress WP Libre Form 2 plugin <= 2.0.8 - Unauthenticated Sensitive Information Disclosure vulnerability

    Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and delete submissions. Affects only versions from 2.0.0 to 2.0.8.

    Libreform WP Libre Form 2 (WordPress plugin) libreform/libreform Web / CMS Packagist
  • High 8.1
    CVE-2022-2714

    Improper Handling of Length Parameter Inconsistency in francoisjacquet/rosariosis

    Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.

    francoisjacquet francoisjacquet/rosariosis francoisjacquet/rosariosis Packagist
  • Medium 4.3
    CVE-2022-35933

    PrestaShop module Product Comments vulnerable to cross-site scripting (XSS)

    This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.

    PrestaShop productcomments prestashop/productcomments Packagist
  • High 8.0
    CVE-2022-3072

    Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis

    Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.

    francoisjacquet francoisjacquet/rosariosis francoisjacquet/rosariosis Packagist
  • Medium 6.1
    CVE-2022-36745

    LibreNMS vulnerable to Cross-Site Scripting (XSS)

    LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php.

    librenms/librenms Packagist
  • Medium 6.1
    CVE-2022-36746

    LibreNMS vulnerable to Cross-Site Scripting (XSS)

    LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.

    librenms/librenms Packagist
  • High 7.1
    GHSA-rv3r-vqjj-8c76

    Cross-site scripting from content entered in the tags and multiselect fields

    ### Introduction Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with …

    getkirby/cms Packagist