Skip to content
OpenAdvisories

Ecosystem

Packagist

7,192 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,182 results · Feed

  • Medium 4.3
    CVE-2024-55894

    TYPO3 Cross-Site Request Forgery in Backend User Module

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-beuser Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55920

    Cross-Site Request Forgery in Dashboard Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-dashboard Web / CMS Packagist
  • High 7.5
    CVE-2024-55921

    Cross-Site Request Forgery in Extension Manager Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-extensionmanager Web / CMS Packagist
  • Medium 5.4
    CVE-2024-55922

    Cross-Site Request Forgery in Form Framework Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-form Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55923

    Cross-Site Request Forgery in Indexed Search Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-indexed-search Web / CMS Packagist
  • High 8.0
    CVE-2024-55924

    Cross-Site Request Forgery in Scheduler Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-scheduler Web / CMS Packagist
  • Medium 4.3
    CVE-2024-55945

    Cross-Site Request Forgery in DB Check Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additiona…

    TYPO3 typo3 typo3/cms-lowlevel Web / CMS Packagist
  • Low 3.1
    CVE-2024-55891

    Information Disclosure via Exception Handling/Logger in TYPO3

    TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 v…

    TYPO3 typo3 typo3/cms-install Web / CMS Packagist
  • Medium 6.1
    CVE-2025-23081

    Various security vulnerabilities in Extension:DataTransfer

    Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XS…

    Wikimedia Foundation Mediawiki - DataTransfer Extension mediawiki/data-transfer Web / CMS Packagist
  • Medium 6.1
    CVE-2024-33298 Public exploit

    Microweber Cross-site Scripting vulnerability

    Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup

    microweber/microweber Packagist
  • Medium 4.7
    CVE-2024-33299 Public exploit

    Microweber Cross-site Scripting vulnerability

    Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users

    microweber/microweber Packagist
  • Medium 4.7
    CVE-2024-33297 Public exploit

    Microweber Cross-site Scripting vulnerability

    Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the Add new campaign function

    microweber/microweber Packagist
  • High 7.3
    CVE-2024-13311

    Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

    Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.

    Drupal Allow All File Extensions for file fields drupal/all_extensions Packagist
  • Medium 6.5
    CVE-2024-13310

    Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

    Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.

    Drupal Git Utilities for Drupal drupal/git_utils Web / CMS Packagist
  • Medium 5.4
    CVE-2024-13309

    Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073

    Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.

    Drupal Login Disable drupal/login_disable Packagist
  • Low 3.8
    CVE-2024-13308

    Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.

    Drupal Browser Back Button drupal/browser_back_button Packagist
  • Medium 4.8
    CVE-2024-13305

    Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.

    Drupal Entity Form Steps drupal/entity_form_steps Packagist
  • Medium 4.5
    CVE-2024-13304

    Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.

    Drupal Minify JS drupal/minifyjs Packagist
  • Medium 5.3
    CVE-2024-13303

    Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069

    Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.

    Drupal Download All Files drupal/download_all_files Packagist
  • Medium 5.3
    CVE-2024-13302

    Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068

    Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.

    Drupal Pages Restriction Access drupal/pages_restriction Packagist
  • Medium 6.1
    CVE-2024-13301

    OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sig…

    Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) drupal/miniorange_oauth_client Packagist
  • Medium 4.8
    CVE-2024-13298

    Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.

    Drupal Tarte au Citron drupal/tarte_au_citron Packagist
  • Medium 6.6
    CVE-2024-13296

    Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062

    Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.

    Drupal Mailjet drupal/mailjet Packagist
  • Medium 5.4
    CVE-2024-13294

    POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.

    Drupal POST File drupal/postfile Packagist
  • Low 3.1
    CVE-2024-13293

    POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.

    Drupal POST File drupal/postfile Packagist
  • Medium 4.8
    CVE-2024-13292

    Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.

    Drupal Tooltip drupal/tooltip Packagist
  • Medium 5.3
    CVE-2024-13290

    OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056

    Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.

    Drupal OhDear Integration drupal/ohdear_integration Packagist
  • Medium 5.4
    CVE-2024-13289

    Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.

    Drupal Cookiebot + GTM drupal/cookiebot_gtm Packagist
  • Medium 4.3
    CVE-2024-13288

    Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052

    Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Medium 5.4
    CVE-2024-13287

    Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.

    Drupal Views SVG Animation drupal/views_svg_animation Packagist
  • Medium 5.4
    CVE-2024-13286

    SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2.

    Drupal SVG Embed drupal/svg_embed Packagist
  • Critical 9.8
    CVE-2024-13285

    wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049

    Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*.

    Drupal wkhtmltopdf drupal/wkhtmltopdf Packagist
  • High 8.8
    CVE-2024-13284

    Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.

    Drupal Gutenberg drupal/gutenberg Packagist
  • Medium 6.1
    CVE-2024-13283

    Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.

    Drupal Facets drupal/facets Packagist
  • High 8.8
    CVE-2024-13282

    Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046

    Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.

    Drupal Block permissions drupal/block_permissions Packagist
  • Critical 9.1
    CVE-2024-13281

    Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045

    Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Critical 9.8
    CVE-2024-13280

    Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044

    Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.

    Drupal Persistent Login drupal/persistent_login Packagist
  • Critical 9.8
    CVE-2024-13279

    Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043

    Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Critical 9.1
    CVE-2024-13278

    Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042

    Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.

    Drupal Diff drupal/diff Packagist
  • Medium 5.3
    CVE-2024-13275

    Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

    Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3.

    Drupal Security Kit drupal/seckit Packagist