Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
Critical 9.8
Remote code execution in prestashop
PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which can be chained to call PHP's Eval function on attacker input. The problem is fixed in version 1.7.8.7.…
-
Medium 5.4
Persistent cross site scripting in customer module in Shopware
Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly…
-
High 7.2
HTTP Host Header Attack Vulnerability in laminas-diactoros
laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can po…
-
High —
mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack
### Impact mezzio-swoole applications using Diactoros for their PSR-7 implementation, and which are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance…
-
Medium 5.4CVE-2022-34140 Public exploit
Feehi CMS Cross-site Scripting
A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field.
-
Unscored —
This module provides a widget to transform entity reference fields into a more user-friendly tags input component with …
-
Unscored —
This module enables you to generate PDF versions of content. Some installations of the module make use of the dompdf/do…
-
High 8.8
Feehi CMS arbitrary code execution via crafted PHP file
An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP file.
-
Medium 6.1CVE-2022-35653 Scanner template
Moodle LTI module reflected XSS risk
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrar…
-
Medium 6.1
Moodle Open redirect risk in mobile auto-login feature
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/d…
-
Medium 6.1
Moodle Stored XSS and blind SSRF possible via SCORM track details
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and s…
-
High 7.5
Moodle Arbitrary file read when importing lesson questions
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks.…
-
Critical 9.8CVE-2022-35649 Public exploit
Moodle PostScript Code Injection
The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation…
-
Medium 6.5
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.
-
Critical 10.0
Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository
### Impact This vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater. ### Patches Upgrade immediately to the [latest release](https://github.com/Islando…
-
Medium 5.3
External Control of File Name or Path in dompdf/dompdf
External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
-
Medium 4.8
WooCommerce < 6.6.0 - Admin+ Stored HTML Injection
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
-
Medium —
Bypass of CMS Safe Mode Security Feature
### Impact Authenticated users with permissions to create or modify theme template objects through the backend "CMS" editor can exploit this vulnerability to bypass the `cms.enableSafeMode` security feature if enabled (disables modification of PHP code throug…
-
Medium 6.9
OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor
# Impact Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager # Relates to - [https://github.com/artf/grapesjs/issues/4411](https://github.com/artf/grapesjs/issues/4411) # …
-
High 7.5
Use of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-library
LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random nonces was not sufficiently cryptographically complex. Users should upgrade to version 5.0 to receive a…
-
High 7.5
Authentication Bypass by Capture-replay in packbackbooks/lti-1-3-php-library
LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.…
-
Unscored —
This module enables you to generate print versions of content. Some installations of the module make use of the dompdf/…
-
Medium 6.1
brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting
The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.
-
Medium 6.1
libconnect Extension for Typo3 Vulnerable to XSS
The libconnect extension before 7.0.8 and 8.x before 8.1.0 for TYPO3 allows XSS.
-
Critical 9.8CVE-2022-35628 EPSS 27%
SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation"
A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.
-
Medium 5.4
Cross site scripting in ameos_tarteaucitron
The ameos_tarteaucitron (aka AMEOS - TarteAuCitron GDPR cookie banner and tracking management / French RGPD compatible) extension before 1.2.23 for TYPO3 allows XSS.
-
Medium 5.4
brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS
The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.
-
High 8.1
Race Condition in October CMS upload process
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an un…
-
High 7.5
Valinor error messages leading to potential data exfiltration
Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use `Throwable#getMessage()` when it should not have permission to do so. This is a problem with cases such as an SQL excep…
-
Medium 6.5
Authentication Bypass by Spoofing in microweber/microweber
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.
-
Medium 6.3
Cross-Site Request Forgery (CSRF) in microweber/microweber
Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user.
-
High 8.8
Known vulnerable to account takeover via host header injection attack in v1.3.1
Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack.
-
Medium 6.1
Known vulnerable to code execution via SVG file in v1.3.1
An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file.
-
Medium 5.4
Known v1.3.1 Cross-site Scripting
A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field.
-
Medium 4.3
Known v1.3.1 contains Insecure Direct Object Reference
Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).
-
Medium 4.8
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
-
Medium 4.8CVE-2022-32060 Public exploit
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.