Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
Medium 6.1
Symfony Open Redirect
An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates…
-
Medium 6.1
Yii2-StateMachine extension for Yii2 XSS Vulnerability
The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.
-
Unscored —
This module enables you to delete any types of entities in bulk. The module doesn't sufficiently verify access permissi…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Medium 5.4
nZEDb Cross-site Scripting (XSS) in the 404 error page
nZEDb v0.7.3.3 has XSS in the 404 error page.
-
Medium 4.8CVE-2018-11564 Public exploit
Pagekit Stored Cross-site Scripting
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will …
-
High 8.0
OpenCart Path Traversal
The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that allows attackers to execute arbitrary code if the remove step is skipped, because the attacker can discover a secret tem…
-
Medium 4.9
OpenCart Path Traversal
OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the download_id. For example, an attacker can download ../../config.php.
-
High 8.1
Moodle Portfolio script allows instantiation of class chosen by user
An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.
-
Medium 4.3
Moodle Cross-site Scripting
An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerabil…
-
High 8.8
Moodle calculated question type allows remote code execution by Question authors
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
-
Medium 6.5
Moodle Portfolio forum caller class allows a user to download any file
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.
-
Medium 6.5
Moodle Improper Privilege Management
An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.
-
Critical 9.8
Dolibarr SQL Injection vulnerability
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list…
-
Medium 6.1
Dolibarr Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
-
High 8.0
Dolibarr arbitrary commands execution
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
-
Critical 9.8
Dolibarr SQL injection vulnerability
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.
-
Medium 4.8
Joomla! XSS Vulnerability
An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attac…
-
Unscored —
This module adds a new formatter for the file fields, which allows any file extension to be uploaded. The module doesn'…
-
Unscored —
Simple Taxonomy Revision module enables revisions for taxonomy terms for Drupal 8. The security team is marking this mo…
-
Critical 9.8
phpMyAdmin Improper Privilege Management
An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions (e.g., version 5). T…
-
Medium 4.8
GeniXCMS Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding a menu.
-
Unscored —
This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration…
-
Unscored —
This module enables you to monitor and manage any number of remote Drupal sites and aggregate useful information for ad…
-
Medium 6.1CVE-2018-10366 Public exploit
User Plugin for October CSS Allows XSS
An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
-
Medium 6.1
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)
Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject a…
-
High 8.8CVE-2018-10188 Public exploit
phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.
-
Critical 9.8
thinkphp SQL Injection via the index.php s parameter
thinkphp 3.1.3 has SQL Injection via the index.php s parameter.
-
Medium 6.1
Cross-site Scripting in Parsedown
Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to s…
-
High 7.5
LightSAML Incorrect Access Control vulnerability
LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been …
-
Unscored —
This module helps in exporting and importing Menu Items via the administrative interface. The module does not properly …
-
Critical 9.8
CSV Injection vulnerability with exported contact lists in Mautic
Mautic before 2.13.0 allows CSV injection.
-
Medium 6.1
XSS vulnerability in theme config file in Mautic
Mautic before v2.13.0 has stored XSS via a theme config file.
-
High 7.5
Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systema…
-
High 8.8
Dolibarr SQL injection vulnerability
Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter).
-
Medium 5.4
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
-
High 8.8
Dolibarr SQL injection via type parameter in product/stats/card.php
Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).
-
Medium 5.4
Dolibarr Cross-Site Scripting (XSS) vulnerability
Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, mon…
-
Medium 4.8CVE-2018-6905 Public exploit
Typo3 XSS Vulnerability
The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.