Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
Medium 6.1
Cross site scripting in the system log
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.
-
Medium 5.3
Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that…
-
Medium 6.5
Form validation can be skipped
neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that t…
-
Medium 6.8
Authentication granted with multiple firewalls
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, …
-
Medium 6.1
MantisBT allows XSS in manage_custom_field_edit_page.php
An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
-
High 8.1
Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer
PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defi…
-
Medium 5.4
Cross-site scripting in PageKit
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website p…
-
Medium 5.4
Moodle Cross Site Scripting (XSS)
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
-
High 8.1
Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows
PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.
-
Unscored —
This module provides a revision UI to Block Content entities. The module doesn't sufficiently respect access restrictio…
-
Unscored —
This module provides a revision UI to Linky entities. The module doesn't sufficiently respect access restrictions to ce…
-
Unscored —
Chaos tool suite (ctools) module provides a number of APIs and extensions for Drupal, its 8.x-3.x branch is a start fro…
-
Critical 9.8
Multiple vulnerabilities leading to RCE
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP c…
-
High 8.1
Remote Code Execution (RCE)
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
-
Medium 6.1
Drupal Core Cross-site scripting vulnerability
Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior …
-
High 8.8
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
-
Medium 6.1CVE-2021-33829 Scanner template
ckeditor4 vulnerable to cross-site scripting
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
-
Medium 6.5
Authentication bypass in SilverStripe GraphQL
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.
-
Medium 4.8
SilverStripe XXE Vulnerability in CSSContentParser
SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving ext…
-
Medium 5.3
FormField with square brackets in field name skips validation
In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.
-
Medium 5.4
Cross-site scripting in ICEcoder
In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed.
-
Critical 10.0CVE-2021-32671 EPSS 40%
XSS vulnerability with translator
Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 (our last beta before v1.0.0) and was not noticed or docume…
-
Critical 9.1
Improper Certificate Validation in WP-CLI framework
WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-C…
-
Unscored —
This module allows users to authenticate against an Oauth 2.0 / OpenID Connect identity provider to login to your Drupa…
-
Unscored —
This module lets you craft and expose a GraphQL web service API. The module does not sufficiently protect arbitrary exc…
-
Medium 4.3
Open Redirect in tenancy
Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only …
-
Medium 5.4
Cross-site scripting in Centreon
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notific…
-
High —
Improper rate limiting in Koel
Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.
-
Critical 9.1
Server-Side Request Forgery in Feehi CMS
Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.
-
Medium —
Information leakage in Error Handler
### Impact Information leakage in Error Handler ### Patches We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security…
-
Medium —
Authenticated Stored XSS in Administration
### Impact Authenticated Stored XSS in Administration ### Patches We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Se…
-
High 7.5CVE-2021-29625 Scanner template
XSS in doc_link
Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only excep…
-
Low —
User enumeration in authentication mechanisms
Description ----------- The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing t…
-
Low —
User enumeration in authentication mechanisms
Description ----------- The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. Resolution ---------- We now ensure that a generic message is returned whether t…
-
Medium 5.3
Drupal Core Access bypass vulnerability
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. A…
-
Medium 4.8
Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
-
Medium 5.3CVE-2021-21424 Public exploit
Prevent user enumeration using Guard or the new Authenticator-based Security
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting t…
-
Unscored —
Chaos tool suite (ctools) module provides a number of APIs and extensions for Drupal, it's 8.x-3.x branch is a start fr…
-
Unscored —
This module enables you to add customizable facets on search pages, from core search or searches provided by Search API…
-
Unscored —
This module provides a new UI experience for node editing using the Gutenberg Editor library. The module did not correc…