Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
High 8.8
Mautic Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email campaigns or (2) delete contacts.
-
Critical 9.1
GeniXCMS Arbitrary User Password Reset Vulnerability
forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) or possibly conduct Arbitrary User Password Reset attacks via a series of requests.
-
Medium 4.8
GeniXCMS Cross-site Scripting
GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element.
-
Medium 5.4
GeniXCMS Cross-site Scripting (XSS)
GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element.
-
Medium 5.3
GeniXCMS Mailbox validation logic vulnerability
GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG_USER_EMAIL_EXIST protection mechanism via a register.php?act=edit&id=1 request.
-
High 8.8
GeniXCMS SQL Injection
GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter.
-
Medium 5.4
GeniXCMS Cross-site Scripting (XSS)
GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator.
-
Medium 5.3
Craft CMS subject to URL forgery
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
-
Medium 5.3
Craft CMS Unauthorized View
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
-
Medium 6.1
Craft CMS XSS Vulnerability
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.
-
Medium 5.4
Canvs Canvas Cross-site Scripting (XSS) via title and content fields
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts > Add New" action, and during creation of new tags and users.
-
Medium 6.1
Craft CMS XSS Vulnerability
Craft CMS before 2.6.2974 allows XSS attacks.
-
Critical 9.8CVE-2016-3109 EPSS 28%
Shopware RCE Vulnerability
The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.
-
High 8.8
Moodle Cross-site request forgery (CSRF) vulnerability
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum pos…
-
Medium 6.5
Moodle Improper Access Control
The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.
-
Medium 4.3
Moodle sensitive information disclosure
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
-
Medium 4.3
Moodle Improper Access Control
The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.
-
High 7.5
Drupal access control bypass vulnerability
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
-
Medium 6.1
MantisBT XSS via my_view_page.php and view_user_page.php
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit…
-
High 8.8
MantisBT allows arbitrary password reset
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
-
Medium 6.1CVE-2017-7725 Public exploit
Concrete CMS vulnerable to cross-site scripting (XSS)
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain na…
-
Critical 9.8CVE-2015-7564 Public exploit
TeamPass vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) c…
-
Medium 6.1CVE-2015-7562 Public exploit
TeamPass vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.
-
Medium 6.1CVE-2017-7391 Scanner template
Magmi XSS Vulnerability
A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and…
-
Medium 6.1
SocialNetwork Cross-Site Scripting (XSS) vulnerability
A Cross-Site Scripting (XSS) was discovered in 'SocialNetwork v1.2.1'. The vulnerability exists due to insufficient filtration of user-supplied data (mail) passed to the 'SocialNetwork-andrea/app/template/pw_forgot.php' URL. An attacker could execute arbitrar…
-
Medium 4.8CVE-2017-7309 EPSS 63%
MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.…
-
Medium 4.8
MantisBT XSS via move_attachments_page.php
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) setting…
-
Medium 4.8
MantisBT XSS via adm_config_report.php's action parameter
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.
-
Medium 5.4
Moodle Cross-site Scripting in the Course summary filter of the Add a new course
In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element.
-
Medium 6.1
Yii Framework Reflected XSS
Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
-
High 8.8
Subrion CMS vulnerable to CSRF in admin/blocks/add
Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter.
-
Medium 5.3
Moodle Global search displays user names for unauthenticated users
In Moodle 3.2.x, global search displays user names for unauthenticated users.
-
Medium 6.1
Moodle XSS in attachments to evidence of prior learning
In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.
-
Medium 6.1
Moodle XSS Vulnerability
In Moodle 3.x, XSS can occur via evidence of prior learning.
-
Critical 9.8
Moodle SQL injection via user preferences
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
-
Medium 6.1
Pi Cross-site Scripting vulnerability
A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the "pi-develop/www/script/editor/markitup/preview/markdown.php" URL. An attacker could execut…
-
Medium 6.1
imdbphp Cross-Site Scripting (XSS)
A Cross-Site Scripting (XSS) was discovered in imdbphp 5.1.1. The vulnerability exists due to insufficient filtration of user-supplied data (name) passed to the "imdbphp-master/demo/search.php" URL. An attacker could execute arbitrary HTML and script code in …
-
Medium 5.3CVE-2017-6370 Public exploit
TYPO3 Information Disclosure Vulnerability
TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.
-
Medium 4.3
BuddyPress Docs plugin Improper Privilege Management
An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions.
-
High 7.5
Drupal editor module incorrectly checks access to inline private files
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.