Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
High 8.8
SQL Injection in francoisjacquet/rosariosis
SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.
-
High 7.1
Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.
-
High 8.6
Cross-site Scripting (XSS) - Stored in neorazorx/facturascripts
Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.
-
High 8.4
Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr
Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.
-
Medium 6.1
Cross-site Scripting in SEOmatic plugin
A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of …
-
Critical 9.8
Code Injection in SEOmatic
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
-
Medium 5.4
Cross site scripting in intelliants/subrion
An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or adding the onerror attribute.
-
Critical 9.0
Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.
-
High 7.5
Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle
Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a …
-
Medium 6.1
Cross-site Scripting in Dolibarr
Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.
-
Medium 6.8
Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.
-
Low 3.7
Failed payment recorded has completed in silverstripe/silverstripe-omnipay
silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like `isNotification()` or `isRedirect()`), if the payment identifier or success URL is exposed it is po…
-
High 8.8
Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.
-
Medium 4.3
easyii CMS out cross-site request forgery
A vulnerability was found in easyii CMS. It has been classified as problematic. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross site request forgery. It is possible to launch the attack remotely. The exploit has be…
-
Medium 6.5
Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts
Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.
-
Critical —
Login timing attack in ibexa/core
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enou…
-
Critical —
Login timing attack in ezsystems/ezpublish-kernel
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enou…
-
Critical —
Login timing attack in ezsystems/ezplatform-kernel
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enou…
-
Medium 5.4
Neos CMS vulnerable to XSS in various backend modules
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in v…
-
High —
Command injection in librenms
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters.
-
Medium 6.1
Cross site scripting in librenms
LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php.
-
High 8.7
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute…
-
Medium —
XSS in various backend modules due to (un)escaping in JS notification module
The notification module displaying flash messages unscapes HTML coming from the server, resulting in XSS vulnerabilities with various names and labels of entities (eg. workspace title or media title). This however means you must be a logged in user with respe…
-
Unscored —
The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. The dev…
-
Unscored —
Entity Browser Block provides a Block Plugin for every Entity Browser on your site. The module didn't sufficiently chec…
-
Unscored —
The Drupal Embed module provides a filter to allow embedding various embeddable items like entities in content fields. …
-
High 8.0
Cross-domain cookie leakage in Guzzle
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cooki…
-
Medium 5.4
Path Traversal in filegator/filegator
Path Traversal in GitHub repository filegator/filegator prior to 7.8.0.
-
Medium 4.3
Session Fixation in filegator/filegator
Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.
-
High 8.1
SQL injection in helloxz/imgurl
imgurl v2.31 was discovered to contain a Blind SQL injection vulnerability via /upload/localhost.
-
High 8.8CVE-2022-29221 Public exploit
PHP Code Injection by malicious block or filename in Smarty
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites t…
-
High 7.2
Arbitrary file upload in ShopXO
An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations.
-
Critical 9.8CVE-2022-30600 Public exploit
Incorrect Calculation in moodle
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
-
Unscored —
The Wingsuit module enables site builders to build UI Patterns (and|or) Twig Components with Storybook and use them wit…
-
Critical 9.8
SQL injection in moodle
A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
-
Medium 4.3
Exposure of Sensitive Information in moodle
A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.
-
Medium 5.3
External Control of Assumed-Immutable Web Parameter in moodle
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
-
Medium 5.4
Cross-site Scripting in moodle
A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
-
Medium 6.1
Cross-site Scripting in Jirafeau
The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaS…
-
Critical 9.8
Account Takeover in neorazorx/facturascripts
Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.