Skip to content
OpenAdvisories

Ecosystem

Packagist

7,192 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,182 results · Feed

  • Medium 5.4
    CVE-2023-44762 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44770 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2023-44761 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44765 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44771 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2023-44766 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made …

    concrete5/concrete5 Packagist
  • Unscored —
    DRUPAL-CONTRIB-2023-048

    This module enables users to log in by email address with minimal configurations. Drupal core contains protection again…

    drupal/mail_login Packagist
  • Medium 4.3
    GHSA-56fm-hfp3-x3w3

    Wallabag user can disable 2FA unintentionally

    ## Impact wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily disable 2FA through `/config/otp/app/disable` and `/config/otp/email/disable`. This vulnerability has a CVSSv3.1 score of 4.3. **You should …

    wallabag/wallabag Packagist
  • Medium 5.4
    CVE-2023-5323

    Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr

    Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.

    Dolibarr dolibarr/dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.0
    CVE-2023-5320

    Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Medium 5.8
    CVE-2023-5318

    Use of Hard-coded Credentials in microweber/microweber

    Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.3
    CVE-2023-5317

    Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Critical 9.1
    CVE-2023-5316

    Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • High 8.3
    CVE-2023-5319

    Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Medium 6.5
    CVE-2023-5227

    Unrestricted Upload of File with Dangerous Type in thorsten/phpmyfaq

    Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Medium 6.4
    CVE-2023-43655

    Remote Code Execution via web-accessible composer.phar

    Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` ena…

    composer composer composer/composer composer Debian Ubuntu Alpine Packagist
  • High 7.5
    CVE-2023-5256

    Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

    In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects si…

    Drupal Core drupal/core drupal7 Ubuntu Packagist
  • Medium 4.3
    CVE-2023-43664

    Employee without any access rights can list all installed modules in Prestashop

    PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been …

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • Medium 6.3
    CVE-2023-43663

    Improper Privilege Management in Prestashop

    PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit `ce1f6708…

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • Medium 5.0
    CVE-2023-5244 Scanner template

    Cross-site Scripting (XSS) - Reflected in microweber/microweber

    Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.

    microweber microweber/microweber microweber/microweber Packagist
  • High 8.8
    CVE-2023-38877

    Economizzer host header injection vulnerability

    A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicke…

    gugoan/economizzer Packagist
  • Medium 6.5
    CVE-2023-38873 Public exploit

    Economizzer vulnerable to Clickjacking

    The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or…

    gugoan/economizzer Packagist
  • Medium 5.3
    CVE-2023-38871

    Economizzer user enumeration vulnerability

    The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an…

    gugoan/economizzer Packagist
  • Low 3.7
    CVE-2023-38872

    Economizzer Insecure Direct Object Reference vulnerability

    An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.

    gugoan/economizzer Packagist
  • High 8.8
    CVE-2023-38874 EPSS 32%

    Economizzer remote code execution vulnerability

    A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards,…

    gugoan/economizzer Packagist
  • Medium 5.4
    CVE-2023-43884

    Subrion CMS Cross-site Scripting vulnerability

    A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' parameter.

    intelliants/subrion Packagist
  • Unscored —
    DRUPAL-CONTRIB-2023-047

    This module enables notifications to be sent to all users of a particular role, or to the content's author when a piece…

    drupal/content_moderation_notifications Packagist
  • Medium 5.4
    CVE-2023-43828

    Subrion CMS Cross-site Scripting vulnerability in /panel/languages

    A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter.

    intelliants/subrion Packagist
  • Medium 5.4
    CVE-2023-43830

    Subrion CMS XSS in /panel/configuration/financial/

    A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum deposit', 'Maximum deposit' and/or 'Maximum …

    intelliants/subrion Packagist
  • Medium 6.1
    CVE-2023-5192

    Excessive Data Query Operations in a Large Data Table in pimcore/demo

    Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.

    pimcore pimcore/demo pimcore/demo Packagist
  • High 8.1
    CVE-2023-2315

    Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2

    Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server

    OpenCart OpenCart opencart/opencart Packagist
  • Medium 5.4
    CVE-2023-42817

    Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations

    Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a us…

    pimcore admin-ui-classic-bundle pimcore/admin-ui-classic-bundle Packagist
  • High 8.8
    CVE-2015-8371

    Composer allows cache poisoning from other projects built on the same host

    Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a server-side build process. The issue occurs because of the way that dist packages are cached. The cache key is de…

    composer/composer composer Debian Packagist
  • Critical 9.8
    CVE-2015-5467

    Yii2 allows attackers to execute any local .php file via a relative path in the view parameter

    web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.

    yiisoft/yii2 Packagist
  • Medium 6.1
    CVE-2018-5478

    Contao Cross-site Scripting vulnerabililty

    Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.

    contao/core Packagist
  • High 8.8
    CVE-2023-38887

    File Upload vulnerability in Dolibarr ERP CRM

    File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.6
    CVE-2023-38888

    Cross Site Scripting vulnerability in Dolibarr ERP CRM

    Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • High 7.2
    CVE-2023-38886 EPSS 30%

    Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script

    An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • High 8.4
    CVE-2023-5060

    Cross-site Scripting (XSS) - DOM in librenms/librenms

    Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1.

    librenms librenms/librenms librenms/librenms Packagist
  • Medium 5.4
    CVE-2023-37611

    Neos CMS Cross Site Scripting vulnerability

    Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/management/media component.

    neos/media-browser Packagist