Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
Low 3.7
Twig Sandbox Information Disclosure
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
-
Unscored —
This module enables you to add social media share buttons on your website to its content and pages. The module doesn't …
-
High 7.5
Moodle SSRF Vulnerability
Moodle 3.5.x before 3.5.4 allows SSRF.
-
Medium 6.1
Microweber XSS Vulnerability
Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.
-
Medium 6.1
Dolibarr Stored Cross-site Scripting in expensereport/card.php
An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note.
-
Critical 9.8
Dolibarr SQL injection via the integer parameters qty and value_unit
An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and value_unit.
-
High 8.8
Bolt Unrestricted Upload of File with Dangerous Type
Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension.
-
Unscored —
This module addresses the General Data Protection Regulation (GDPR) that came into effect 25th May 2018, and the EU Dir…
-
Unscored —
This module enables you to create facet-filters for results of a search query and exposes them as blocks The module doe…
-
Critical 9.8
elFinder command injection vulnerability in the PHP connector
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
-
High 8.1
Drupal core - Highly critical - Remote Code Execution
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions …
KEV Mar 25, 2022 -
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. Not all …
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. Not all …
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. Not all …
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. Not all …
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module. Not all …
-
Unscored —
This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module.
-
Medium 6.1
Bootstrap Vulnerable to Cross-Site Scripting
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
-
Critical 9.8
Joomla! Object Injection Vulnerability
An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
-
Unscored —
Acquia Connector facilitates sending certain telemetry data to Acquia for the purposes of analysis. The module automate…
-
Unscored —
This module provides a field on user profiles which allows users to get a notification when their account logs in to th…
-
Medium 6.1
MODX Revolution allows XSS through extended user fields
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.
-
Medium 5.4
MODX vulnerability allows for XSS via user settings parameters
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.
-
Medium 6.1
MODX Revolution vulnerable to XSS attack through its User Photo field
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
-
Medium 6.1
MODX Revolution allows XSS via document resources
MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.
-
Medium 6.5
Incorrect Access Control vulnerability in api-platform/core
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must …
-
High 8.8
mPDF Unsafe Deserialization
mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProcessor class that can result in Arbitry code execution, file write, etc.. This attack appears to be exploitable via attack…
-
Critical 9.8
TeamPass Storing Passwords in a Recoverable Format vulnerability
TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability t…
-
Medium 4.8
Croogo vulnerable to XSS in title field
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies.
-
Medium 4.8
Croogo vulnerable to Cross-site Scripting in title field
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4.
-
Medium 4.8
Croogo vulnerable to XSS in Blog field
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog.
-
Medium 4.8
Croogo vulnerable to XSS in title field
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8.
-
Medium 4.8
Croogo vulnerable to XSS in title field
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/edit/3.
-
Medium 5.9
Yii Incorrectly Implements CORS
Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
-
Critical 9.8
phpMyAdmin SQL injection in Designer feature
An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.
-
Medium 5.9
phpMyAdmin Arbitrary file read vulnerability
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to…
-
Unscored —
Anti-spam module by CleanTalk to protect your Drupal sites from spambot registration and spam comments publications thr…
-
Unscored —
The Preview Link module enables you to generate preview links so anonymous users can access unpublished revisions of co…
-
Medium 6.5
Access bypass in Drupal 8 views
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated …
-
Medium 6.5
Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than al…