Skip to content
OpenAdvisories

Ecosystem

Packagist

7,191 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,181 results · Feed

  • Medium 4.8
    CVE-2025-31476

    tarteaucitron.js allows url scheme injection via unfiltered inputs

    tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as java…

    amauric tarteaucitron.js tarteaucitronjs drupal/tacjs npm Packagist
  • High 8.2
    CVE-2025-3192

    Browsershot Server-Side Request Forgery (SSRF) via setURL() Function

    Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories.

    spatie/browsershot Packagist
  • High 7.5
    CVE-2025-31485

    GraphQL grant on a property might be cached with different objects

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is me…

    api-platform core api-platform/core api-platform/graphql Packagist
  • High 7.5
    CVE-2025-31481

    GraphQL query operations security can be bypassed

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.

    api-platform core api-platform/core api-platform/graphql Packagist
  • Medium 5.3
    CVE-2023-47639

    API Platform Core can leak exceptions message that may contain sensitive information

    API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5.

    api-platform core api-platform/core Packagist
  • Medium 5.1
    CVE-2025-3153

    Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attribute

    Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country is not specified.  Attackers are limited to individu…

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2025-3130

    Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obfuscate: from 0.0.0 before 2.0.1.

    Drupal Obfuscate drupal/obfuscate Packagist
  • Medium 4.8
    CVE-2025-3129

    Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.

    Drupal Access code drupal/access_code Packagist
  • High 8.6
    CVE-2025-31131 Public exploit Scanner template

    Path Traversal allowing arbitrary read of files in Yeswiki

    YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.

    YesWiki yeswiki yeswiki/yeswiki Packagist
  • Medium 6.6
    CVE-2025-3062

    Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010

    Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*.

    Drupal Drupal Admin LTE theme drupal/druadmin_lte_theme Web / CMS Packagist
  • Medium 6.6
    CVE-2025-3061

    Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006

    Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.

    Drupal Material Admin drupal/material_admin Packagist
  • Medium 5.3
    CVE-2025-3059

    Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002

    Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*.

    Drupal Profile Private drupal/profile_private Packagist
  • Medium 6.1
    CVE-2025-31697

    Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0.

    Drupal Formatter Suite drupal/formatter_suite Packagist
  • Medium 6.1
    CVE-2025-31696

    RapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1.

    Drupal RapiDoc OAS Field Formatter drupal/rapidoc_elements_field_formatter Packagist
  • Medium 6.1
    CVE-2025-31695

    Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0.

    Drupal Link field display mode formatter drupal/link_field_display_mode_formatter Packagist
  • High 8.1
    CVE-2025-31694

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

    Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Medium 6.6
    CVE-2025-31693

    AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 7.5
    CVE-2025-31692

    AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Critical 9.8
    CVE-2025-31691

    OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020

    Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.

    Drupal OAuth2 Server drupal/oauth2_server Packagist
  • High 8.8
    CVE-2025-31690

    Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.

    Drupal Cache Utility drupal/cache_utility Packagist
  • High 8.1
    CVE-2025-31689

    General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

    Drupal General Data Protection Regulation drupal/gdpr Packagist
  • Medium 6.8
    CVE-2025-31688

    Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.

    Drupal Configuration Split drupal/config_split Packagist
  • Medium 6.1
    CVE-2025-31687

    SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.

    Drupal SpamSpan filter drupal/spamspan Packagist
  • High 8.1
    CVE-2025-31686

    Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

    Drupal Open Social goalgorilla/open_social Packagist
  • Critical 9.1
    CVE-2025-31685

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

    Drupal Open Social goalgorilla/open_social Packagist
  • Medium 6.8
    CVE-2025-31684

    OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.

    Drupal OAuth2 Client drupal/oauth2_client Packagist
  • Medium 6.8
    CVE-2025-31683

    Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

    Drupal Google Tag drupal/google_tag Packagist
  • Medium 4.8
    CVE-2025-31682

    Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

    Drupal Google Tag drupal/google_tag Packagist
  • Critical 9.8
    CVE-2025-31681

    Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009

    Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.

    Drupal Authenticator Login drupal/alogin Packagist
  • Medium 6.8
    CVE-2025-31680

    Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.

    Drupal Matomo Analytics drupal/matomo Packagist
  • Medium 6.1
    CVE-2025-31679

    Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.

    Drupal Ignition Error Pages drupal/ignition Packagist
  • High 8.2
    CVE-2025-31678

    AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.8
    CVE-2025-31677

    AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.8
    CVE-2025-31676

    Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

    Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.

    Drupal Email TFA drupal/email_tfa Packagist
  • Medium 5.4
    CVE-2025-31675

    Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before…

    Drupal Drupal core Link drupal/core Web / CMS Packagist
  • High 7.5
    CVE-2025-31674

    Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 1…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 4.6
    CVE-2025-31673

    Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

    Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2025-3057

    Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.9
    CVE-2025-31128

    gifplayer XSS vulnerability

    gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 0.3.7.

    rubentd gifplayer drupal/gifplayer gifplayer npm Packagist
  • Medium 5.4
    CVE-2025-28254

    Leantime affected by Improper Neutralization of HTML Tags

    Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().

    leantime/leantime Packagist