Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
Low 2.6
Insufficient Session Expiration in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. F…
-
Medium 4.8
Guest session is shared between customers in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. …
-
Medium 6.1
HTML injection possibility in voucher code form
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workaro…
-
Medium 6.3
HTTP caching is marking private HTTP headers as public
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client the…
-
Medium 6.8
Incorrect Authentication in shopware
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api rout…
-
Unscored —
This module is used as part of the Opigno LMS distribution and implements learning paths for the LMS. The module was pr…
-
Unscored —
SVG Formatter module provides support for using SVG images on your website. Our dependency library enshrined/svg-saniti…
-
Medium 5.3
PhpMyAdmin exposure of sensitive information
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
-
High 7.1
Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
-
Critical 9.1
Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.
-
High 7.3
Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube
alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is miti…
-
High 7.6
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.
-
Medium 6.1CVE-2020-18325 Public exploit
Cross-site Scripting in intelliants/subrion
Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.
-
Medium 6.1CVE-2020-18324 Public exploit
Cross-site Scripting in Subrion CMS
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.
-
High 8.8CVE-2020-18326 Public exploit
Cross Site Request Forgery in intelliants/subrion
Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary …
-
Medium 4.6CVE-2022-0832 EPSS 67%
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
-
Medium 4.6
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
-
Medium 5.4
Cross-site Scripting in GeniXCMS
In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.
-
High 7.2CVE-2022-0819 EPSS 43%
Code Injection in dolibarr/dolibarr
Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.
-
High 7.3
Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber
Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.
-
Medium 5.4
Cross-site Scripting in Cipi
Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.
-
Medium 4.6
Cross-site Scripting (XSS) - Stored in getgrav/grav
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
-
Medium 6.3
Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to v…
-
Critical 9.4
Remote CLI Command Execution Vulnerability in CodeIgniter4
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no k…
-
High 8.6
Server-Side Request Forgery (SSRF) in rudloff/alltube
Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.
-
Medium 4.7
Cross-site Scripting (XSS) - Stored in librenms/librenms
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2.
-
High 8.0
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.
-
Medium 4.3
Cross-site Scripting (XSS) - Stored in microweber/microweber
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.
-
Medium 5.5
Incorrect Authorization in microweber/microweber
Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.
-
High 7.2CVE-2022-26149 Public exploit
Unrestricted Upload of File with Dangerous Type in MODX Revolution
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
-
Medium 4.3
Business Logic Errors in dolibarr/dolibarr
Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
-
Medium 5.3
EC-CUBE improperly handles HTTP Host header values
EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE use…
-
High 8.1
Multi-Factor Authentication issue in Laravel Fortify
Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
-
Medium 4.8
Missing server signature validation in OctoberCMS
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advis…
-
Critical 9.1
Arbitrary file delete in ectouch/ectouch
ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.
-
High 7.2CVE-2022-21705 Scanner template
Authenticated remote code execution in octobercms
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vu…
-
Medium 5.4
Improper Access Control (IDOR) in dolibarr/dolibarr
Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.
-
Unscored —
The GOV.UK Theme (`govuk_theme`) is a Drupal theme for the GOV.UK Design System. The theme doesn't sanitize user input …
-
Unscored —
This module provides an entity relationship hierarchy tree widget for an entity reference field. The module doesn't suf…
-
Critical 9.1
Insecure Storage of Sensitive Information in microweber/microweber
Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.