Browse CVEs by Ecosystem and Severity

AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion

NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference

elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)

Snipe-IT has Privilege Escalation via API Permissions Assignment

Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete

Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()

Low-privileged Grav API users can create super-admin accounts via blueprint-upload

Grav is Vulnerable to Stored XSS via Tag Injection

Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component

Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

Grav API Privilege Escalation to Super Admin

AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

phpBB has Password Reset Link Poisoning via Host Header injection

Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest

Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type

Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution

Dolibarr Allows Code Injection through its Website Module

Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions

YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()

elFinder: Command injection in resize background color parameter when using ImageMagick CLI

Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar

Statamic: Unsafe method invocation via query value resolution allows data destruction

WWBN AVideo: RCE cause by clonesite plugin

Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection

WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

Composer has a command injection via malicious perforce reference

Webkul Krayin CRM has Server-Side Request Forgery (SSRF)

Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php

Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget

Craft Commerce hasVariant/hasProduct Blind SQL Injection

Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php

OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals

OpenSTAManager: SQL Injection via Aggiornamenti Module

phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter

baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)

Saloon has insecure deserialization in AccessTokenAuthenticator

AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment