Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
Medium 6.1
Cross-site Scripting in teampass
Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.
-
Critical 10.0
Sandbox bypass in fenom
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary PHP code when disable_native_funcs is true.
-
High 8.1
Path Traversal in ImpressCMS
ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.
-
Critical 9.8
Type Confusion in ImpressCMS
ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).
-
Critical 9.8
SQL Injection in ImpressCMS
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
-
Medium 5.3
Incorrect Access Control in ImpressCMS
ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).
-
High —
Arbitrary shell execution
A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option
-
High —
Arbitrary shell execution
Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases
-
Low 3.7
Discoverability of user password hash in Statamic CMS
Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such reques…
-
High 8.8
SQL Injection in Moodle
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
-
High 7.5
SQL Injection in Yeswiki
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.
-
Critical 9.0
SQL injection through marking blog comments on bulk as spam in forkcms/forkcms
SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.
-
Medium 4.5
Cross-Site Request Forgery in Anchor CMS
Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.
-
Critical 9.6
SQL Injection in forkcms/forkcms
SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.
-
Medium 6.5
Cross-site Scripting (XSS) - Stored in pimcore/data-hub
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in forkcms/forkcms
Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.
-
Medium 5.3
Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber
Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.
-
Critical 9.1
There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in star7th/showdoc
There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.
-
High 7.5
Improper Input Validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are current…
-
Critical 9.1
Path Traversal in Studio-42 elFinder through 2.1.60
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
-
Medium 4.0CVE-2022-25481 Scanner template
Exposure of Resource to Wrong Sphere in ThinkPHP Framework
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an inte…
-
High 8.2
Insufficient Session Expiration in admidio/admidio
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.
-
Medium —
Possibility for Denial of Service by overwriting PHP files with language exports
### Impact Laravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service.…
-
Critical 9.8
Remote Code Execution in Contao Managed Edition
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
-
Critical 9.8
Improper Privilege Management in Open Web Analytics
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intend…
-
Medium 4.2
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
-
Medium 4.0
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
-
Medium 5.4
Cross-site Scripting in CKEditor4
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malf…
-
High 7.1
Cross-site Scripting (XSS) - Stored in getgrav/grav
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
-
High 7.2CVE-2022-0968 Scanner template
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber pri…
-
High 8.0
Stored XSS viva .webmv file upload in star7th/showdoc
Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.
-
Critical 9.0
Stored XSS viva .ofd file upload in star7th/showdoc
Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.
-
Medium 6.4
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc
Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.
-
Medium 6.9CVE-2022-0967 Public exploit
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.
-
Medium 5.7CVE-2022-0963 Scanner template
Unrestricted XML Files Leads to Stored XSS in microweber/microweber
Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
-
High 7.1
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.
-
Critical 9.8
SQL Injection through sorting parameters in SyliusGridBundle
SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL in…
-
Critical 9.4
Stored XSS due to Unrestricted File Upload in star7th/showdoc
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
-
High 7.6
Stored XSS via File Upload in star7th/showdoc
Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.