Skip to content
OpenAdvisories

Ecosystem

Packagist

7,192 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,182 results · Feed

  • Unscored —
    DRUPAL-CONTRIB-2023-031

    The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator int…

    drupal/symfony_mailer Packagist
  • Medium 5.4
    CVE-2023-37692

    Stored Cross-Site Scripting October CMS

    An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.

    october/october Packagist
  • Medium 4.7
    CVE-2023-38500

    By-passing Cross-Site Scripting Protection in HTML Sanitizer

    TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in…

    TYPO3 HTML Sanitizer typo3/html-sanitizer Packagist
  • Low 3.7
    CVE-2023-38499

    typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution

    TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope a…

    TYPO3 typo3 typo3/cms-core Web / CMS Packagist
  • Medium 4.7
    GHSA-m8fw-p3cr-6jqc

    Cross-Site Scripting in CKEditor4 WordCount Plugin

    > ### CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.4) ### Problem The [WordCount](https://ckeditor.com/cke4/addon/wordcount) plugin ([`npm:ckeditor-wordcount-plugin`](https://www.npmjs.com/package/ckeditor-wordcount-plugin)) for CKEdi…

    typo3/cms-rte-ckeditor Packagist
  • Medium 6.5
    CVE-2023-36806

    Contao cross site scripting vulnerability via input unit widget

    Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed b…

    contao contao contao/core-bundle Packagist
  • Medium 6.0
    CVE-2023-3822

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.1
    CVE-2023-3821

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • High 7.2
    CVE-2023-3820

    SQL Injection in pimcore/pimcore

    SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • High 7.6
    CVE-2023-3819

    Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore

    Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • High 7.5
    CVE-2023-37649

    Cockpit CMS vulnerable to incorrect access control

    Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.

    cockpit-hq/cockpit Packagist
  • High 8.8
    CVE-2023-37650

    Cockpit CMS Cross-Site Request Forgery vulnerability

    A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.

    cockpit-hq/cockpit Packagist
  • High 7.2
    CVE-2023-37897

    Server-side Template Injection (SSTI) in grav

    Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass …

    getgrav grav getgrav/grav Packagist
  • Medium 6.3
    CVE-2023-3700

    Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments

    Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

    Alex Tselegidis alextselegidis/easyappointments alextselegidis/easyappointments Packagist
  • Medium 6.7
    CVE-2023-3692

    Unrestricted Upload of File with Dangerous Type in admidio/admidio

    Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.

    Admidio admidio/admidio admidio/admidio Packagist
  • High 8.6
    CVE-2023-37473

    Limited code execution in zenstruck/collections

    zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were co…

    zenstruck collection zenstruck/collection Packagist
  • High 7.2
    CVE-2023-3673

    SQL Injection in pimcore/pimcore

    SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Critical 9.1
    CVE-2023-3668

    Improper Encoding or Escaping of Output in froxlor/froxlor

    Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Medium 4.8
    CVE-2023-37785

    ImpressCMS Cross-site Scripting vulnerability

    A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the component /editprofile.php.

    impresscms/impresscms Packagist
  • Unscored —
    DRUPAL-CONTRIB-2023-030

    This module enables you to allow and/or require users to use a second authentication method in addition to password aut…

    drupal/tfa Packagist
  • Medium 5.0
    CVE-2023-37280

    Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page

    Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute …

    pimcore admin-ui-classic-bundle pimcore/admin-ui-classic-bundle Packagist
  • Critical 9.7
    CVE-2023-36825

    Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution

    Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untruste…

    orchidsoftware platform orchid/platform Packagist
  • Medium 6.3
    CVE-2023-3574

    Improper Authorization in pimcore/customer-data-framework

    Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.

    pimcore Pimcore Customer Data Framework pimcore/customer-management-framework-bundle Packagist
  • Low 3.5
    CVE-2023-3566

    wallabag Profile Config config allocation of resources

    A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of reso…

    wallabag/wallabag Packagist
  • Medium 5.2
    CVE-2023-3565

    Cross-site Scripting (XSS) - Generic in nilsteampassnet/teampass

    Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • Medium 5.3
    CVE-2023-3553

    Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass

    Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • High 7.6
    CVE-2023-3552

    Improper Encoding or Escaping of Output in nilsteampassnet/teampass

    Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • Critical 9.1
    CVE-2023-3551

    Code Injection in nilsteampassnet/teampass

    Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • Low 2.0
    CVE-2023-37269 Public exploit

    Winter CMS vulnerable to stored XSS through privileged upload of SVG file

    Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could …

    wintercms winter wintercms/winter Packagist
  • High 8.1
    CVE-2023-3531

    Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

    Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • High 8.2
    CVE-2023-37260

    league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase

    league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had t…

    thephpleague oauth2-server league/oauth2-server Packagist
  • Medium 4.3
    GHSA-qxh3-jgvh-x55j

    Connect-CMS Privilege Escalation Vulnerability

    ### Impact（影響） There is a Privilege Escalation Vulnerability on the management system of Connect-CMS. Affercted Version : Connect-CMS 1.7.1, 2.3.1 and earlier ### Patches（修正バージョン） version 1.7.2, 2.3.1 ### Workarounds（運用回避手段） Upgrade Connect-CMS to latest vers…

    opensource-workshop/connect-cms Packagist
  • Medium 5.5
    CVE-2023-36828

    Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

    Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even wh…

    statamic cms statamic/cms Packagist
  • Medium 5.2
    CVE-2023-3469

    Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Medium 6.1
    CVE-2023-37302

    MediaWiki Cross-site Scripting vulnerability

    An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a…

    mediawiki wikibase/wikibase Ubuntu Packagist
  • Unscored —
    DRUPAL-CONTRIB-2023-029

    This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficientl…

    drupal/tacjs Packagist
  • Unscored —
    DRUPAL-CONTRIB-2023-028

    This module enables you to render a field in an expandable/collapsible region. The module doesn't sufficiently sanitize…

    drupal/expandable_formatter Packagist
  • Unscored —
    DRUPAL-CONTRIB-2023-027

    This module enables a UI to display all libraries provided by modules and themes on the Drupal site. The module doesn't…

    drupal/libraries_ui Packagist
  • Unscored —
    DRUPAL-CONTRIB-2023-026

    This module enables you to use complex autocompletion in forms. The module doesn't sufficiently filter text in the data…

    drupal/search_autocomplete Packagist
  • Unscored —
    DRUPAL-CONTRIB-2023-025

    This module provides integration with Mailchimp, a popular email delivery service. A route related to OAuth authenticat…

    drupal/mailchimp Packagist