Skip to content
OpenAdvisories

Ecosystem

Packagist

7,192 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,182 results · Feed

  • Medium 6.4
    CVE-2021-32668

    Cross-Site Scripting in Query Generator & Query View

    TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGen…

    TYPO3 TYPO3 CMS typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 6.4
    CVE-2021-32667

    Cross-Site Scripting in Page Preview

    TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding …

    TYPO3 TYPO3 CMS typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 5.4
    CVE-2021-28114 EPSS 52%

    Cross-site Scripting in Froala WYSIWYG Editor

    Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.

    froala/wysiwyg-editor Packagist
  • Critical 9.8
    CVE-2020-18155

    SQL Injection in Subrion CMS

    SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.

    intelliants/subrion Packagist
  • Medium 6.5
    CVE-2020-18151

    ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability

    Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.

    thinkcmf/thinkcmf Packagist
  • High 7.2
    CVE-2021-32752

    Files or Directories Accessible to External Parties in ether/logs

    Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed authenticated admin users to access any file on the server. The vulnerability has been fixed in ver…

    ethercreative logs ether/logs Packagist
  • High 8.3
    CVE-2021-23405

    SQL Injection

    This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.

    pimcore/pimcore Packagist
  • Medium 4.8
    CVE-2020-23700

    Cross-site scripting in LavaLite-CMS

    Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.

    lavalite/cms Packagist
  • High 8.8
    CVE-2021-28931

    Arbitrary file upload in Fork CMS

    Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.

    forkcms/forkcms Packagist
  • High 8.4
    CVE-2021-32737

    XSS Injection in Media Collection Title was possible

    Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patche…

    sulu sulu sulu/sulu Packagist
  • Medium 5.4
    CVE-2020-36397

    LavaLite Stored Cross-site Scripting vulnerability

    A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2020-36396

    Stored XSS in LavaLite 5.8.0

    A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

    lavalite/cms Packagist
  • Medium 5.4
    CVE-2020-36395

    Stored XSS in LavaLite 5.8.0

    A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

    lavalite/cms Packagist
  • High 7.1
    CVE-2021-32735

    Cross-site scripting (XSS) from field and configuration text displayed in the Panel

    Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks. …

    getkirby kirby getkirby/cms Packagist
  • Unscored —
    DRUPAL-CONTRIB-2021-022

    This module provides a revision UI for Block Content entities. The module doesn't sufficiently respect access restricti…

    drupal/block_content_revision_ui Packagist
  • Unscored —
    DRUPAL-CONTRIB-2021-021

    This module provides a revision UI for Linky entities. The module doesn't sufficiently respect access restrictions to c…

    drupal/linky_revision_ui Packagist
  • Unscored —
    DRUPAL-CONTRIB-2021-020

    The Apigee Edge module allows connecting a Drupal site to Apigee Edge in order to build a developer portal. The module …

    drupal/apigee_edge Packagist
  • Critical 9.8
    CVE-2021-27903

    Craft CMS Remote Code Injection

    An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).

    craftcms/cms Packagist
  • Medium 6.1
    CVE-2021-27902

    Craft CMS Cross-site Scripting Vulnerability

    An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.

    craftcms/cms Packagist
  • Medium 5.3
    CVE-2021-32720

    List of order ids, number, items total and token value exposed for unauthorized uses via new API

    Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploit…

    Sylius Sylius sylius/sylius Packagist
  • Medium —
    GHSA-243q-g9j3-qf6r

    non-admin users can create integration role with administrator role

    ### Impact non-admin users can create integration role with administrator role ### Patches We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. https://ww…

    shopware/platform shopware/core Packagist
  • Medium —
    GHSA-wq3r-jwrq-xg6w

    Canceling of orders not related to the logged-in user

    ### Impact Canceling of orders not related to the logged-in user ### Patches We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com…

    shopware/platform shopware/core Packagist
  • Medium 5.4
    CVE-2021-28584

    Magento Commerce path traversal vulnerability in child theme store creation

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated…

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist
  • Medium 5.3
    CVE-2021-28585

    Magento Commerce improper input validation in customer customer webapi

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails.

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist
  • High 7.5
    CVE-2021-28583

    Magento Commerce insecure storage of sensitive documentation

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized acce…

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist
  • Medium 6.5
    CVE-2021-28563

    Magento Commerce improper Authorization via the 'Create Customer' endpoint

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer dat…

    Adobe Magento Commerce magento/community-edition Web / CMS Packagist
  • Medium 6.9
    CVE-2021-28556

    Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthe…

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist
  • Medium 6.1
    CVE-2021-20751

    EC-CUBE Cross-site scripting vulnerability

    Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.

    EC-CUBE EC-CUBE ec-cube/ec-cube Packagist
  • Medium 6.1
    CVE-2021-20750

    EC-CUBE Cross-site scripting vulnerability

    Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted pa…

    EC-CUBE EC-CUBE ec-cube/ec-cube Packagist
  • High 7.5
    CVE-2021-32717

    Private files publicly accessible with Cloud Storage providers

    Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility acco…

    shopware platform shopware/platform shopware/core Packagist
  • Medium 4.4
    CVE-2021-32716

    Internal hidden fields are visible on to many associations in admin api

    Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the u…

    shopware platform shopware/platform shopware/core Packagist
  • Medium 5.3
    CVE-2021-32712

    Information leakage in Error Handler

    Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directl…

    shopware shopware shopware/shopware Packagist
  • Medium 4.8
    CVE-2021-32713

    Authenticated Stored XSS

    Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updat…

    shopware shopware shopware/shopware Packagist
  • Critical 9.1
    CVE-2021-32711

    Leak of information via Store-API

    Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API …

    shopware platform shopware/platform Packagist
  • Medium 5.9
    CVE-2021-32710

    Potential Session Hijacking in Shopware

    Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via th…

    shopware platform shopware/platform Packagist
  • Medium 4.9
    CVE-2021-32709

    Creation of order credits was not validated by acl in admin orders

    Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via t…

    shopware platform shopware/platform shopware/core Packagist
  • Critical 9.8
    CVE-2021-32708 Public exploit

    Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem

    Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The condition…

    thephpleague flysystem league/flysystem php-league-flysystem Debian Ubuntu Packagist
  • High 8.2
    CVE-2021-21809 Public exploit EPSS 24%

    Moodle command execution vulnerability exists in the default legacy spellchecker plugin

    A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Unscored —
    DRUPAL-CONTRIB-2021-019

    This project is related to Opigno LMS distribution. It implements the group manager in the Opigno LMS. The module does …

    drupal/opigno_group_manager Packagist
  • Unscored —
    DRUPAL-CONTRIB-2021-018

    This project is related to Opigno LMS distribution. It implements the learning path, that combines together in a very f…

    drupal/opigno_learning_path Packagist