Browse CVEs by Ecosystem and Severity

Contao: Cross-site scripting in the comments bundle

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

phpMyFAQ's two-factor authentication login bypasses the password factor

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Snipe-IT: 2FA bypass via the API token flow

Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

Grav CMS vulnerable to remote code execution via .zip file upload

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Shopper: Missing authorization on product removal actions in CollectionProducts component

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper: privilege escalation via improper Livewire admin component authorization

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

mongodb: Reject "." and NUL bytes in database and collection names

Composer arbitrary command execution via a malicious package's Perforce source URL

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

Kirby: Access to image files outside of the site root via path traversal in the media handling

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

EasyAdmin custom-action dispatcher bypasses access_control on other routes

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Snipe-IT has CSS Injection via `header_color` Setting

Snipe-IT vulnerable to stored XSS via inline-served attachment

silverstripe/userforms vulnerable to remote code execution via userforms email subject

phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk