Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
High 8.8
Insertion of Sensitive Information Into Debugging Code in microweber/microweber
Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.
-
High 7.6
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.
-
Critical 9.8
SQL injection in francoisjacquet/rosariosis
An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.
-
Medium 5.4
Cross site scripting in francoisjacquet/rosariosis
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php.
-
Medium 5.4
Cross site scripting in francoisjacquet/rosariosis
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown inp…
-
High 7.2
File upload restriction bypass in Zenario CMS
Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' i…
-
Medium 4.9
Path Traversal in pimcore/pimcore
Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.
-
Medium 4.7CVE-2022-0692 Scanner template
Open Redirect on Rudloff/alltube in rudloff/alltube
Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.
-
Critical 9.4
Business Logic Errors in microweber/microweber
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
-
High 8.8
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
-
Medium 5.3
Use multiple time the one-time coupon in microweber/microweber
Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.
-
Medium 6.5CVE-2022-0678 Scanner template
Cross-site Scripting (XSS) - Reflected in microweber/microweber
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
-
High 7.2
Unrestricted Upload of File with Dangerous Type in star7th/showdoc
Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.
-
High 7.5
SSRF in Kitodo.Presentation
An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This re…
-
Medium 5.3
Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.
-
Critical 9.8
Code injection in ezsystems/ezpublish-kernel
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.
-
High 7.6
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
-
Critical 9.4CVE-2022-0660 Scanner template
Generation of Error Message Containing Sensitive Information in microweber/microweber
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in microweber/microweber
Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
-
Medium 5.3
Crypt_GPG does not prevent additional options in GPG calls
The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
-
Medium 5.3
Generation of Error Message Containing Sensitive Information in snipe/snipe-it
Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.
-
Medium 6.5
Incorrect authorization in Drupal core
The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit mo…
-
Unscored —
This advisory addresses a similar issue to [Drupal core - Moderately critical - Information disclosure - SA-CORE-2022-0…
-
High 7.3
Prototype Pollution
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized …
-
Critical 9.8
Adobe Commerce checkout improper input validation leads to remote code execution
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code e…
KEV Feb 15, 2022 -
Medium 6.7
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
-
High 7.5
Improper input validation in Drupal core
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certa…
-
Medium 6.3
Missing Authorization in snipe/snipe-it
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.
-
Medium 4.3CVE-2022-0597 Scanner template
Open Redirect in microweber/microweber
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in librenms/librenms
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
-
High 7.1
Missing Authorization in librenms/librenms
Missing Authorization in Packagist librenms/librenms prior to 22.2.0.
-
High 7.1
Improper Authorization in librenms/librenms
Improper Authorization in Packagist librenms/librenms prior to 22.2.0.
-
Medium 5.4
Improper Validation of Specified Quantity in Input in microweber/microweber
Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.
-
High 7.1
Incorrect Authorization in librenms/librenms
Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0.
-
Medium 6.2
Cross-site Scripting in svg-sanitizer
svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.
-
Medium 6.5
Missing Authorization in snipe/snipe-it
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in librenms/librenms
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.
-
Medium 5.4
Cross-site Scripting (XSS) - Generic in librenms/librenms
Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
-
Critical 9.8
Path Traversal in ImpressCMS
ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS w…
-
Medium 5.3
Observable Discrepancy in snipe/snipe-it
Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.