Skip to content
OpenAdvisories

Ecosystem

Packagist

7,192 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,182 results · Feed

  • Medium 5.4
    CVE-2021-27131

    Moodle vulnerable to stored Cross-site Scripting

    Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal ad…

    moodle/moodle Packagist
  • High 8.8
    CVE-2023-32073 Public exploit

    AVideo command injection vulnerability

    WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-…

    WWBN AVideo wwbn/avideo Packagist
  • Critical 9.8
    CVE-2023-27238

    LavaLite vulnerable to web cache poisoning

    LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.

    lavalite/cms Packagist
  • Medium 6.1
    CVE-2023-27237

    LavaLite CMS vulnerable to host header injection attack

    LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.

    lavalite/cms Packagist
  • Medium 6.8
    CVE-2023-2666

    Allocation of Resources Without Limits or Throttling in froxlor/froxlor

    Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • High 7.5
    CVE-2023-2665

    Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis

    Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.

    francoisjacquet francoisjacquet/rosariosis francoisjacquet/rosariosis Packagist
  • High 8.8
    CVE-2023-30130

    CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter

    An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.

    craftcms/cms Packagist
  • Medium 4.3
    CVE-2023-32075

    Pimcore vulnerable to Business Logic Errors in Customer automation rules

    The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be …

    pimcore customer-data-framework pimcore/customer-management-framework-bundle Packagist
  • Medium 5.4
    GHSA-r3fg-3r88-6x3f

    Ibexa User Settings are accessible on the front-end for anonymous user

    ### Impact This security advisory is about the user settings, which include things like preferred time zone and number of items per page in item listings. These could be accessed by the anonymous user. This impacted only the anonymous users themselves, and ha…

    ibexa/user Packagist
  • Medium 5.0
    CVE-2023-2629

    Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.

    pimcore Pimcore Customer Data Framework pimcore/customer-management-framework-bundle Packagist
  • Medium 6.8
    CVE-2023-2615

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.8
    CVE-2023-2614

    Cross-site Scripting (XSS) - DOM in pimcore/pimcore

    Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.7
    CVE-2023-2630

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.8
    CVE-2023-2616

    Cross-site Scripting (XSS) - Generic in pimcore/pimcore

    Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.1
    CVE-2023-31144

    Craft CMS vulnerable to cross site scripting in RSS feed widget

    Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.

    craftcms cms craftcms/cms Packagist
  • High 7.1
    CVE-2023-2591 Public exploit

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nilsteampassnet/teampass

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • High 8.0
    CVE-2023-30860

    WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

    WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting…

    WWBN AVideo wwbn/avideo Packagist
  • Medium 6.5
    CVE-2023-30855

    Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php

    Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this path traversal and arbitrary extension is limited to creation of arbitrary files and appending data to…

    pimcore pimcore pimcore/pimcore Packagist
  • High 7.3
    CVE-2023-2531

    Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast

    Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3.

    AzuraCast azuracast/azuracast azuracast/azuracast Packagist
  • High 8.2
    CVE-2023-2550

    Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Medium 5.4
    CVE-2023-2516 Public exploit

    Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

    Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • Medium 6.1
    CVE-2023-2427

    Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Unscored —
    DRUPAL-CONTRIB-2023-014

    S3 File System (s3fs) provides an additional file system to your Drupal site, which stores files in Amazon's Simple Sto…

    drupal/s3fs Packagist
  • Medium 5.4
    CVE-2023-29918 Public exploit

    RosarioSIS vulnerable to CSV Injection

    RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

    francoisjacquet/rosariosis Packagist
  • Medium 6.5
    CVE-2023-30943 Public exploit Scanner template

    Moodle: tinymce loaders susceptible to arbitrary folder creation

    The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.6
    CVE-2023-30944

    Moodle: minor sql injection risk in external wiki method for listing pages

    The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL comman…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.6
    CVE-2023-2429

    Improper Access Control in thorsten/phpmyfaq

    Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Medium 6.1
    CVE-2023-2428

    Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • High 8.8
    CVE-2023-30854 Public exploit

    WWBN AVideo vulnerable to OS Command Injection

    AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.

    WWBN AVideo wwbn/avideo Packagist
  • Critical 9.8
    CVE-2023-28473

    Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.

    concrete5/concrete5 Packagist
  • Low 2.0
    CVE-2023-28820

    Stored cross site scripting in RSS displayer

    Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

    concrete5/concrete5 Packagist
  • Low 3.5
    CVE-2023-28819

    Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names

    Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-28476

    Stored cross site scripting on tags

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-28471

    Stored cross site scripting via container name

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-28474

    Stored cross site scripting on saved presets

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.

    concrete5/concrete5 Packagist
  • Medium 5.3
    CVE-2023-28821

    Missing rate limit for password resets

    Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

    concrete5/concrete5 Packagist
  • Medium 5.5
    CVE-2023-28477

    Stored cross site scripting on API integration

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.

    concrete5/concrete5 Packagist
  • Medium 6.1
    CVE-2023-28475

    Reflected cross site scripting

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.

    concrete5/concrete5 Packagist
  • Medium 5.3
    CVE-2023-28472

    Concrete CMS missing secure cookie parameters

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies.

    concrete5/concrete5 Packagist
  • Medium 6.3
    CVE-2023-2361

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist