Skip to content
OpenAdvisories

Ecosystem

Packagist

7,192 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,182 results · Feed

  • Medium 5.3
    CVE-2024-13274

    Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038

    Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.

    Drupal Open Social goalgorilla/open_social Packagist
  • Medium 6.3
    CVE-2024-13272

    Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036

    Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.

    Drupal Paragraphs table drupal/paragraphs_table Packagist
  • Medium 4.3
    CVE-2024-13271

    Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035

    Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.

    Drupal Content Entity Clone drupal/content_entity_clone Packagist
  • Medium 4.3
    CVE-2024-13270

    Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034

    Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.

    Drupal Freelinking drupal/freelinking Packagist
  • Medium 5.3
    CVE-2024-13269

    Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.

    Drupal Advanced Varnish drupal/adv_varnish Packagist
  • Medium 5.3
    CVE-2024-13266

    Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030

    Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.

    Drupal Responsive and off-canvas menu drupal/responsive_menu Packagist
  • High 7.5
    CVE-2024-13265

    Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.

    Drupal Opigno Learning path drupal/opigno_learning_path Packagist
  • Critical 9.8
    CVE-2024-13264

    Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.

    Drupal Opigno module drupal/opigno_module Packagist
  • Medium 5.5
    CVE-2024-13263

    Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.

    Drupal Opigno group manager drupal/opigno_group_manager Packagist
  • Medium 4.8
    CVE-2024-13262

    View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).This issue affects View Password: from 0.0.0 before 6.0.4.

    Drupal View Password drupal/view_password Packagist
  • Low 3.5
    CVE-2024-13261

    Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.

    Drupal Acquia DAM drupal/acquia_dam Packagist
  • High 8.8
    CVE-2024-13260

    Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.

    Drupal Migrate queue importer drupal/migrate_queue_importer Packagist
  • High 7.5
    CVE-2024-13259

    Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.

    Drupal Image Sizes drupal/image_sizes Packagist
  • Critical 9.8
    CVE-2024-13258

    Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022

    Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.

    Drupal Drupal REST & JSON API Authentication drupal/rest_api_authentication Web / CMS Packagist
  • Medium 5.3
    CVE-2024-13257

    Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

    Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.

    Drupal Commerce View Receipt drupal/commerce_view_receipt Packagist
  • High 7.5
    CVE-2024-13256

    Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020

    Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.

    Drupal Email Contact drupal/email_contact Packagist
  • High 7.5
    CVE-2024-13254

    REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.

    Drupal REST Views drupal/rest_views Packagist
  • Critical 9.1
    CVE-2024-13253

    Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017

    Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.

    Drupal Advanced PWA inc Push Notifications drupal/advanced_pwa Packagist
  • Medium 5.4
    CVE-2024-13252

    TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue affects TacJS: from 0.0.0 before 6.5.0.

    Drupal TacJS drupal/tacjs Packagist
  • High 8.8
    CVE-2024-13251

    Registration role - Critical - Access bypass - SA-CONTRIB-2024-015

    Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1.

    Drupal Registration role drupal/registration_role Packagist
  • High 8.8
    CVE-2024-13250

    Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.

    Drupal Drupal Symfony Mailer Lite drupal/symfony_mailer_lite Web / CMS Packagist
  • Medium 5.5
    CVE-2024-13248

    Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012

    Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.

    Drupal Private content drupal/private_content Packagist
  • Medium 4.8
    CVE-2024-13247

    Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issue affects Coffee: from 0.0.0 before 1.4.0.

    Drupal Coffee drupal/coffee Packagist
  • Medium 5.3
    CVE-2024-13246

    Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010

    Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.

    Drupal Node Access Rebuild Progressive drupal/node_access_rebuild_progressive Packagist
  • Medium 5.4
    CVE-2024-13245

    CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor 4 LTS - WYSIWYG HTML editor allows Cross-Site Scripting (XSS).This issue affects CKEditor 4 LTS - WYSIWYG HTML editor: from 1.0.0 before 1.0.…

    Drupal CKEditor 4 LTS - WYSIWYG HTML editor drupal/ckeditor_lts Packagist
  • High 8.8
    CVE-2024-13244

    Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3.

    Drupal Migrate Tools drupal/migrate_tools Packagist
  • Medium 6.5
    CVE-2024-13243

    Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

    Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.

    Drupal Entity Delete Log drupal/entity_delete_log Packagist
  • Critical 9.1
    CVE-2024-13242

    Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006

    Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*.

    Drupal Swift Mailer (abandoned) drupal/swiftmailer Packagist
  • Critical 9.8
    CVE-2024-13239

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003

    Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Medium 5.4
    CVE-2024-13238

    Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This issue affects Typogrify: from 0.0.0 before 1.3.0.

    Drupal Typogrify py3.11-typogrify py3.10-typogrify Wolfi Packagist
  • Low 2.4
    CVE-2024-13209

    Redaxo CMS Structure Management Page index.php cross site scripting

    A vulnerability was found in Redaxo CMS 5.18.1. It has been classified as problematic. Affected is an unknown function of the file /index.php?page=structure&category_id=1&article_id=1&clang=1&function=edit_art&artstart=0 of the component Structure Management …

    redaxo CMS redaxo/source Packagist
  • Medium 6.3
    CVE-2025-22145

    Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

    Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include …

    CarbonPHP carbon php-nesbot-carbon nesbot/carbon Debian Ubuntu Packagist
  • High 7.3
    GHSA-95m2-chm4-mq7m

    PHP-Textile has persistent XSS vulnerability in image link handling

    ### Details Persistent XSS vulnerability in image link handling of PHP-Textile versions 4.1.2 and older, when running the parser in restricted mode. In restricted mode it is expected that the input would be sanitized, allowing user-input (such as user comment…

    netcarver/textile Packagist
  • Medium 6.3
    CVE-2025-21617

    Guzzle OAuth Subscriber has insufficient nonce entropy

    Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This …

    guzzle oauth-subscriber guzzlehttp/oauth-subscriber Packagist
  • High 8.6
    CVE-2025-21612

    Cross-site Scripting in TabberTransclude in Extension:TabberNeue

    TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.

    StarCitizenTools mediawiki-extensions-TabberNeue starcitizentools/tabber-neue Web / CMS Packagist
  • Medium 6.1
    CVE-2024-35498

    Grav Cross-site Scripting vulnerability

    A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

    getgrav/grav Packagist
  • Medium 5.4
    CVE-2024-46209 Public exploit

    REDAXO CMS Cross-site Scripting vulnerability

    A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter.

    redaxo/source Packagist
  • Medium 4.8
    CVE-2024-56412

    PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can u…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet phpoffice/phpexcel Packagist
  • Medium 4.8
    CVE-2024-56411

    PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability of the hyperlink base in the HTML page header. The HTML page is formed without sanitiz…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet phpoffice/phpexcel Packagist
  • Medium 4.8
    CVE-2024-56410

    PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties

    PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. V…

    PHPOffice PhpSpreadsheet phpoffice/phpspreadsheet phpoffice/phpexcel Packagist