Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
Critical 9.8
slub_events for Typo3 Arbitrary File Upload
The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial…
-
Medium 5.4
Dolibarr Cross-site Scripting via outgoing email setup feature
An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the /admin/mails.php?action=edit URI via the "Send all emails to (instead of real recipients, for test purposes)" field.
-
Medium 5.4
Dolibarr Cross-site Scripting via outgoing email setup feature
An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Email used for error returns emails (fields 'Errors-To' in emails sent)" field.
-
Medium 5.4
Dolibarr Cross-site Scripting vulnerability
An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Sender email for automatic emails (default value in php.ini: Undefined)" field.
-
Unscored —
The Bat module provides a foundation through which a wide range of availability management, reservation and booking use…
-
Medium 6.1
Dolibarr ERP and CRM HTML Injection
There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.
-
Medium 6.1
Craft CMS XSS Vulnerability
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
-
Medium 4.8
z-song laravel-admin XSS via the Slug or Name on the Roles screen
z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen.
-
High 7.2
MantisBT Remote Code Execution
MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.
-
Medium 6.5
Centreon Sensitive Data Exposure
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.
-
High 7.5
Centreon Does Not Set HTTPOnly Flag
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.
-
Critical 9.8
Centreon Privilege Escalation
In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.
-
Medium 5.4
TeamPass Stored Cross-site Scripting
TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.
-
Medium 5.4
TeamPass Stored Cross-site Scripting
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.
-
Medium 6.1
TeamPass Stored Cross-site Scripting
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
-
Unscored —
This module allows display of a site's content in AMP format. The module doesn't sufficiently check access on unpublish…
-
High 8.8
phpBB Cross-Site Request Forgery (CSRF)
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthentic…
-
Medium 5.4
Dolibarr stored Cross-site Scripting in an Email Template section
Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)
-
Medium 5.4
Dolibarr Cross-site Scripting in a User Profile in a Signature section
Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
-
Medium 5.4
Dolibarr Cross-site Scripting in a User Note section
Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.
-
Medium 5.4
Dolibarr stored Cross-site Scripting vulnerability
Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
-
Medium 6.5
phpBB Cross-Site Request Forgery (CSRF)
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
-
Medium 5.3
SilverStripe Versioned Files module Unpublished files are exposed publicly
In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles so…
-
Low 2.7
SilverStripe Priviledge escalation through cache pollution
In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.
-
Medium 5.4
SilverStripe asset-admin Cross-site Scripting (XSS)
In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.
-
Medium 5.3
Broken access control on files
In SilverStripe assets 4.0, there is broken access control on files.
-
Medium 5.4
TeamPass Cross-site Scripting (XSS) vulnerability
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. (The crafted password is exploitable when viewing the change history of the item or tapping on the item.)
-
Medium 5.3
MediaWiki information disclosure
In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.
-
Medium 6.1
Silverstripe Flash Clipboard Reflected XSS
SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.
-
Medium 6.3
Session fixation in change password form
SilverStripe through 4.3.3 allows session fixation in the "change password" form.
-
Medium 5.3
Lack of access control on upoaded files
SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
-
Critical 9.8
Missing warning can lead to unauthenticated admin access in SilverStripe
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.
-
Critical 9.8
SQL injection in Centreon
SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.
-
Unscored —
This module provides a new UI experience for node editing - Gutenberg editor. The routes used by the Gutenberg editor l…
-
Unscored —
This module enables you to control access to content based on taxonomy terms. The module doesn't sufficiently check if …
-
Medium 6.1
Joomla! XSS in Default Templates
In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.
-
Medium 5.3
Pagekit User enumeration
The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts.
-
Medium 6.1
XSS vulnerability in company name field in Mautic
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
-
Unscored —
This module allows you to attach tabular data to an entity. There is insufficient access checking for users with the ab…
-
Unscored —
This module enables you to have a separate permission only for creating users. The module doesn't respect Drupal's sett…