Browse CVEs by Ecosystem and Severity

OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution

Dolibarr Allows Code Injection through its Website Module

Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions

YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()

elFinder: Command injection in resize background color parameter when using ImageMagick CLI

Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration

Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar

Statamic: Unsafe method invocation via query value resolution allows data destruction

WWBN AVideo: RCE cause by clonesite plugin

goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution

Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection

WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

Composer has a command injection via malicious perforce reference

Webkul Krayin CRM has Server-Side Request Forgery (SSRF)

Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php

Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget

Craft Commerce hasVariant/hasProduct Blind SQL Injection

Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php

CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals

CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

OpenSTAManager: SQL Injection via Aggiornamenti Module

phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise

CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS

CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter

CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

baserCMS Update Functionality Vulnerable to OS Command Injection

baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)

baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)

ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

Saloon has insecure deserialization in AccessTokenAuthenticator