Browse CVEs by Ecosystem and Severity

Paymenter has URL parameter injection that bypasses paid plan limits at checkout

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

Paymenter vulnerable to Remote Code Execution via public file uploads

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

Cotonti: Cross-Site Request Forgery in the administration rights handler

Laravel Framework: CRLF injection in default email rule

Project Firefly III has incorrect access control in the webhook management component

shlink has a Server-Side Request Forgery issue

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

TYPO3 CMS has Broken Access Control in its Form Framework

TYPO3 CMS: Destructive Actions on File Mount Folders

TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework

TYPO3 CMS has Broken Access Control in its Form Framework

TYPO3 CMS has Insecure Deserialization via Core API

CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule

Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter

SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.

LimeSurvey has a SQL Injection issue

PHPSpreadsheet has a patch bypass for CVE-2026-34084

Twig: Possible sandbox bypass when using a source policy

Shopper: Authorization bypass and RBAC privilege escalation in team settings

Shopper: Multiple data integrity and disclosure issues in admin Livewire components

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

Spatie Laravel Media Library contains a file upload restriction bypass

Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path

Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration

Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup

Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints

Dolibarr ERP CRM contains a remote code evaluation vulnerability