Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
Medium 6.1
Cross-site Scripting in LibreNMS
LibreNMS through 21.10.2 allows XSS via a widget title.
-
Critical 9.1
XML External Entity vulnerability in MODX CMS
A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in getgrav/grav
grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Low 3.5
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 5.7
Authenticated Stored XSS in Administration
Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the …
-
Medium 4.3
logout CSRF in Pterodactyl Panel
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-…
-
Medium 5.4
Cross-site scripting in forkcms
Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web script…
-
Medium 5.4
Foxlor cross-site scripting (XSS) vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields.
-
Critical 9.8
Showdoc File Upload Vulnerability
ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions.
-
Medium 6.2
Improper Neutralization HTML tags in sulu/sulu
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags…
-
Medium —
Cross Site Scripting in Microweber
Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting code in the request form.
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.5
Cross-site Scripting (XSS) - Generic in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 5.0
Open Redirect in firefly-iii/firefly-iii
firefly-iii is vulnerable to URL Redirection to Untrusted Site
-
Medium 6.3
Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii
firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
-
Medium 6.5
Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition
Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer …
-
Unscored —
This module enables aklump/loft\_data\_grids to be used as a Drupal module. Excel support was provided by <https://pack…
-
Critical 9.8
Froxlor SQL injection vulnerability
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
-
Medium 5.3
MediaWiki allows a denial of service
MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled.
-
Medium 6.1
Cross-site Scripting in Limesurvey
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
-
Medium 4.3
SilverStripe GraphQL Server permission checker not inherited by query subclass.
Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
-
Medium 6.1
Cross-site Scripting in SilverStripe Framework
SilverStripe Framework through 4.8.1 allows XSS.
-
High 8.2
Server-Side Request Forgery vulnerability in concrete5
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services expo…
-
High 8.1
Authentication bypass in Pterodactyl
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmation_token` input during the two-factor authentication process to reference a cache value not associated with th…
-
High 7.2
Deleted Admin Can Sign In to Admin Interface
October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue h…
-
High 7.5
Unauthorized access to Credit card form in sylius/paypal-plugin
sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy to predict. The pro…
-
High 8.2
Command injection in composer on Windows
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not aff…
-
High 8.8
Cross-Site-Request-Forgery in Backend URI Handling in Typo3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows users to create and share deep links in the backend user interface is vulnerable to cross-site-reques…
-
Medium 4.8
HTTP Host Header Injection in Request Handling in Typo3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example,…
-
Medium 6.1CVE-2021-41467 Scanner template
Cross-site scripting in application/controllers/dropbox.php in JustWriting
Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.
-
Medium 6.1
Cross-site scripting in demos/demo.mysqli.php in getID3
Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter.
-
High 8.8
CSV Injection Vulnerability
Craft CMS before 3.7.14 allows CSV injection.
-
Medium 5.4
Cross-site Scripting in LaraCMS
LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content editor.
-
High —
User can obtain JWT token even if account is disabled
Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. (Someone who never had an account cannot exploit this vulnerability.) The fix ensure…
-
Unscored —
Linkit provides an easy interface for internal and external linking with WYSIWYG editors by using an autocomplete field…
-
Critical 9.8
SQL Injection in topthink/thinkphp
ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.
-
Medium 4.4
File reference keys leads to incorrect hashes on HMAC algorithms
JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens …
-
High 8.8
Cross-Site Request Forgery in GilaCMS
A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts.