Skip to content
OpenAdvisories

Ecosystem

Packagist

7,191 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,181 results · Feed

  • High 8.8
    GHSA-49xw-hw94-fmv2

    Dolibarr has Remote Code Execution Vulnerability (Bypass)

    # Summary The Dolibarr backend provides the function of adding Menu, and supports setting permissions for the added Menu: ![](https://raw.githubusercontent.com/wh0amitx/Misc/main/images/image-20240228164114688.png) This is the trigger point of the vulnerabili…

    dolibarr/dolibarr Packagist
  • High 7.5
    CVE-2025-7717

    File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089

    Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1.

    Drupal File Download drupal/file_download Packagist
  • Medium 6.1
    CVE-2025-7716

    Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting (XSS).This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0.

    Drupal Real-time SEO for Drupal drupal/yoast_seo Web / CMS Packagist
  • Medium 6.1
    CVE-2025-7715

    Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Attributes allows Cross-Site Scripting (XSS).This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1.

    Drupal Block Attributes drupal/block_attributes Packagist
  • Medium 6.1
    CVE-2025-7392

    Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).This issue affects Cookies Addons: from 1.0.0 before 1.2.4.

    Drupal Cookies Addons drupal/cookies_addons Packagist
  • Critical 9.8
    CVE-2025-7393

    Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.

    Drupal Mail Login drupal/mail_login Packagist
  • High 8.1
    CVE-2025-54082

    nova-tiptap has an Unauthenticated Arbitrary File Upload Vulnerability

    marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to…

    marshmallow-packages nova-tiptap manogi/nova-tiptap marshmallow/nova-tiptap Packagist
  • Critical 9.8
    CVE-2025-46001

    simogeo/filemanager arbitrary file upload vulnerability

    An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.

    simogeo/filemanager Packagist
  • Medium 6.5
    CVE-2025-46002

    Filemanager is vulnerable to Relative Path Traversal through filemanager.php

    An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.

    simogeo/filemanager Packagist
  • Critical 9.2
    CVE-2025-54068 Exploited Public exploit Scanner template EPSS 96%

    Livewire vulnerable to remote command execution during property update hydration

    Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates …

    livewire livewire livewire/livewire Packagist
    KEV Mar 20, 2026
  • Critical 10.0
    CVE-2025-53833 Public exploit Scanner template

    LaRecipe is vulnerable to Server-Side Template Injection attacks

    LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable…

    saleem-hadad larecipe binarytorch/larecipe Packagist
  • Medium 4.9
    CVE-2025-52994

    phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

    gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.

    phpThumb project phpThumb james-heinrich/phpthumb Packagist
  • High 8.7
    CVE-2025-53625

    DynamicPageList3 exposes hidden/suppressed usernames

    The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideus…

    Universal-Omega DynamicPageList3 universal-omega/dynamic-page-list3 Packagist
  • Medium 5.3
    CVE-2025-7031

    Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086

    Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Config Pages Viewer: from 0.0.0 before 1.0.4.

    Drupal Config Pages Viewer drupal/config_pages_viewer Packagist
  • Medium 6.5
    CVE-2025-7030

    Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085

    Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Low 3.5
    CVE-2025-7053

    Cockpit save cross site scripting

    A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initia…

    cockpit-hq/cockpit Packagist
  • High 8.6
    CVE-2025-53369

    Citizen Short Description stored XSS vulnerability through wikitext

    Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into …

    StarCitizenTools mediawiki-extensions-ShortDescription starcitizentools/short-description Web / CMS Packagist
  • High 7.5
    CVE-2025-34086 Public exploit

    Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename

    Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, whic…

    bolt CMS bolt/bolt bolt Azure Linux Packagist
  • High 8.6
    CVE-2025-53370

    Citizen stored XSS vulnerability through short descriptions

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitra…

    StarCitizenTools mediawiki-skins-Citizen starcitizentools/citizen-skin Web / CMS Packagist
  • High 8.6
    CVE-2025-53368

    Citizen is vulnerable to stored XSS attack in the legacy search bar

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with p…

    StarCitizenTools mediawiki-skins-Citizen starcitizentools/citizen-skin Web / CMS Packagist
  • Medium 6.1
    CVE-2025-34076 Public exploit

    Microweber CMS Authenticated Local File Inclusion via Backup API

    An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files fr…

    microweber CMS microweber/microweber Packagist
  • High 8.6
    CVE-2025-53093

    TabberNeue vulnerable to Stored XSS through wikitext

    TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.…

    StarCitizenTools mediawiki-extensions-TabberNeue starcitizentools/tabber-neue Web / CMS Packagist
  • Medium 6.3
    CVE-2025-44163

    raspap-webgui has a Directory Traversal vulnerability

    RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the we…

    billz/raspap-webgui Packagist
  • Medium 6.3
    CVE-2025-6736

    juzaweb CMS Add New Themes Page install improper authorization

    A vulnerability classified as critical was found in juzaweb CMS 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/theme/install of the component Add New Themes Page. The manipulation leads to improper authorization. The a…

    juzaweb CMS juzaweb/cms Packagist
  • Medium 6.3
    CVE-2025-6735

    juzaweb CMS Import Page imports improper authorization

    A vulnerability classified as critical has been found in juzaweb CMS 3.4.2. Affected is an unknown function of the file /admin-cp/imports of the component Import Page. The manipulation leads to improper authorization. It is possible to launch the attack remot…

    juzaweb CMS juzaweb/cms Packagist
  • Medium 5.4
    CVE-2025-6677

    Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS).This issue affects Paragraphs table: from 2.0.0 before 2.0.5.

    Drupal Paragraphs table drupal/paragraphs_table Packagist
  • Medium 5.4
    CVE-2025-6676

    Simple XML sitemap - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-083

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XSS).This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2.

    Drupal Simple XML sitemap drupal/simple_sitemap Packagist
  • Medium 4.8
    CVE-2025-6675

    Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 befo…

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • Medium 6.1
    CVE-2025-6674

    CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS).This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3.

    Drupal CKEditor5 Youtube drupal/ckeditor5_youtube Packagist
  • Medium 4.3
    CVE-2025-5682

    Klaro Cookie & Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7.

    Drupal Klaro Cookie & Consent Management drupal/klaro Packagist
  • Medium 6.1
    CVE-2025-48922

    GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This issue affects GLightbox: from 0.0.0 before 1.0.16.

    Drupal GLightbox drupal/glightbox Packagist
  • Medium 6.1
    CVE-2025-48923

    Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: from 0.0.0 before 3.2.1.

    Drupal Toc.js drupal/toc_js Packagist
  • Medium 4.3
    CVE-2025-49550

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security meas…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Low 2.7
    CVE-2025-49549

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypas…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 4.2
    CVE-2025-53021

    Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter

    A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the vic…

    Moodle moodle moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Critical 10.0
    CVE-2025-49132 Public exploit Scanner template EPSS 54%

    Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

    Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the…

    pterodactyl panel pterodactyl/panel Packagist
  • Low 3.9
    CVE-2025-49597

    handcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code Execution

    handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerabil…

    handcraftedinthealps goodby-csv handcraftedinthealps/goodby-csv Packagist
  • High 8.6
    CVE-2025-48915

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • High 8.6
    CVE-2025-48914

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • High 7.3
    CVE-2025-48920

    etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0.

    Drupal etracker drupal/etracker Packagist