Skip to content
OpenAdvisories

Ecosystem

Packagist

7,192 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,182 results · Feed

  • High 7.1
    CVE-2022-0956

    Stored XSS via File Upload in star7th/showdoc

    Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.8
    CVE-2022-0954 Scanner template

    Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in microweber/microweber

    Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.8
    CVE-2022-0893

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • High 8.2
    CVE-2022-0894

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • High 8.2
    CVE-2022-0951

    File Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdoc

    File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.5
    CVE-2022-0950

    Unrestricted Upload of File with Dangerous Type in star7th/showdoc

    Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Critical 9.0
    CVE-2022-0945

    Stored XSS viva axd and cshtml file upload in star7th/showdoc in star7th/showdoc

    Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.1
    CVE-2022-24749

    Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius

    Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open…

    Sylius Sylius sylius/sylius Packagist
  • High 7.1
    CVE-2022-24743

    Insufficient Session Expiration in Sylius

    Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and un…

    Sylius Sylius sylius/sylius Packagist
  • Medium 5.0
    CVE-2022-24742

    Exposure of Sensitive Information Due to Incompatible Policies in Sylius

    Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. …

    Sylius Sylius sylius/sylius Packagist
  • Medium 6.1
    CVE-2022-24733

    Improper Restriction of Rendered UI Layers or Frames in Sylius

    Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays…

    Sylius Sylius sylius/sylius Packagist
  • Critical 9.0
    CVE-2022-0962

    Stored XSS viva .webma file upload in star7th/showdoc

    Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 4.8
    CVE-2021-41952

    Cross-site Scripting in Zenario CMS

    Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.

    tribalsystems/zenario Packagist
  • Critical 9.8
    CVE-2021-42171 Public exploit

    Unrestricted Upload of File with Dangerous Type in Zenario CMS

    Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and …

    tribalsystems/zenario Packagist
  • Critical 9.0
    CVE-2022-0960

    Stored XSS viva .properties file upload in star7th/showdoc

    Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Critical 9.8
    CVE-2022-0254

    Zero Spam < 5.2.11 - Admin+ SQL Injection

    The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection

    bmarshall511/wordpress_zero_spam Web / CMS Packagist
  • Critical 9.0
    CVE-2022-0946

    Stored XSS viva cshtm file upload in star7th/showdoc

    Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • High 7.3
    CVE-2022-0941

    Stored XSS due to Unrestricted File Upload in star7th/showdoc

    Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.3
    CVE-2022-0940

    Stored XSS due to Unrestricted File Upload in star7th/showdoc

    Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • High 7.1
    CVE-2022-0938

    Stored XSS via file upload in star7th/showdoc

    Stored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 6.3
    CVE-2022-0937

    Stored xss in showdoc through file upload in star7th/showdoc

    Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • High 8.0
    CVE-2022-0930

    File upload filter bypass leading to stored XSS in microweber/microweber

    File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.8
    CVE-2022-0929

    XSS on dynamic_text module in microweber/microweber

    XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • High 7.1
    CVE-2022-0926

    File upload filter bypass leading to stored XSS in microweber/microweber

    File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.

    microweber microweber/microweber microweber/microweber Packagist
  • High 7.6
    CVE-2022-0880

    Cross-site Scripting (XSS) - Stored in star7th/showdoc

    Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.

    star7th star7th/showdoc showdoc/showdoc Packagist
  • Medium 5.3
    CVE-2021-32473

    Moodle Information Disclosure vulnerability

    It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 7.2
    CVE-2021-32474

    Moodle Blind SQL injection possible via MNet authentication

    An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2021-32475

    Moodle stored Cross-site Scripting

    ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2021-32477

    Moodle Exposure of Sensitive Information to an Unauthorized Actor

    The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 7.2
    CVE-2022-0921

    Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber

    Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.

    microweber microweber/microweber microweber/microweber Packagist
  • Critical 9.8
    CVE-2021-44618

    Server-side Template Injection in nystudio107/craft-seomatic

    A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.

    nystudio107/craft-seomatic Packagist
  • Medium 6.8
    CVE-2022-0928 Scanner template

    Cross-site Scripting (XSS) - Stored in microweber/microweber

    Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 4.8
    CVE-2022-0912

    Unrestricted Upload of File with Dangerous Type in microweber/microweber

    Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.

    microweber microweber/microweber microweber/microweber Packagist
  • Critical 9.1
    CVE-2022-0913

    Integer Overflow or Wraparound in microweber/microweber

    Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.1
    CVE-2021-32478 Scanner template

    Moodle reflected XSS

    The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 7.5
    CVE-2021-32476

    Moodle denial-of-service risk in the draft files area

    A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2021-32472

    Moodle Exposure of Sensitive Information to an Unauthorized Actor

    Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and 3.8 to 3.8.8 are affected.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 8.8
    CVE-2021-44673 Public exploit

    Unrestricted Upload of File with Dangerous Type in Croogo

    A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script.

    croogo/croogo Packagist
  • Medium 4.3
    CVE-2022-0906

    Unrestricted file upload leads to stored XSS in microweber/microweber

    Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.

    microweber microweber/microweber microweber/microweber Packagist
  • High 7.7
    CVE-2022-0895

    Static Code Injection in microweber/microweber

    Static Code Injection in GitHub repository microweber/microweber prior to 1.3.

    microweber microweber/microweber microweber/microweber Packagist