Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
High 8.8
Authenticated server-side request forgery in file upload via URL.
Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available v…
-
High 8.0
Cross-Site Scripting via SVG media files
Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measure…
-
Medium 6.5
Insecure direct object reference of log files of the Import/Export feature
Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.…
-
High 8.8
Command injection in mail agent settings
Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measure…
-
Medium 6.5
Manipulation of product reviews via API
Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding secur…
-
Medium 5.4
Cross-site scripting in imgURL
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.
-
Critical 9.0
Stored XSS in “Dolibarr” leads to privilege escalation
In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These script…
-
Medium 4.0
SQL injection in TYPO3 extension
The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.
-
High 7.5
Improper Resource Shutdown or Release in TYPO3 extension
The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.
-
Medium 6.8
CSRF token exposure in TYPO3 extension
The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclosure because a session identifier is unsafely present in HTML output.
-
Medium —
Cross-site Scripting in the femanager TYPO3 extension
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
-
High 7.5
Sensitive Data Exposure in miniorange_saml
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.
-
High 8.5
Cross-site Scripting in TYPO3 extension
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.
-
Medium 5.4
Cross-site Scripting in the yoast_seo TYPO3 extension
The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.
-
Medium 5.4CVE-2021-37704 Scanner template
Exposed phpinfo() in PhpFastCache
PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation tod…
-
Unscored —
The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4), library for WYSIWYG editing. CKEditor ha…
-
Medium 5.9
Cross site scripting via HTML attributes in the back end
Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.
-
High 8.0
Privilege escalation via form generator
Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in the Contao back end. Installations are only affected if they have untrusted back end users who have a…
-
High 7.2
PHP file inclusion via insert tags
Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back en…
-
High 7.7
Deserialization of Untrusted Data
This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.
-
Medium 6.1
Cross-Site Scripting via Rich-Text Content
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to…
-
High 8.1
Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
-
High 8.1
Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
-
Medium 4.3
Improper Access Control in “Dolibarr”
In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/…
-
Medium 6.1
Subrion Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.
-
Medium 5.4
Cross Site Scripting in Subrion CMS
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
-
Medium 5.4
Akaunting Password Reset Relay
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in …
-
High 7.5
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc
showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
-
Medium 5.3
Missing Cryptographic Step in star7th/showdoc
showdoc is vulnerable to Missing Cryptographic Step
-
Critical 9.8
NukeViet SQL Injection vulnerability
SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.
-
Critical 9.8
NukeViet SQL Injection vulnerability via topicsid parameter
SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php.
-
Medium 6.1
NukeViet Cross-site Scripting via the editor in the News module
Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.
-
Unscored —
This project enables administrators to restrict access from anonymous and regular users to pre-defined pages. The admin…
-
High 7.1CVE-2021-32610 EPSS 73%
Directory Traversal in Archive_Tar
In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
-
Critical 9.8
Code injection in topthink/think
A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.
-
Medium 4.8
Cross Site Scripting in LavaLite CMS
Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
-
Medium 5.3
Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii
firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
-
Unscored —
This module provides a user interface that allows the implementation and use of *Form modes* without custom development…
-
Medium 5.3
Information Disclosure in User Authentication
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is n…
-
Medium 6.4
Cross-Site Scripting in Backend Grid View
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for _backend layouts_ are not properly encoded, the corr…