Browse CVEs by Ecosystem and Severity

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

phpMyFAQ's two-factor authentication login bypasses the password factor

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Snipe-IT: 2FA bypass via the API token flow

Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

Grav CMS vulnerable to remote code execution via .zip file upload

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Shopper: Missing authorization on product removal actions in CollectionProducts component

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper: privilege escalation via improper Livewire admin component authorization

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

mongodb: Reject "." and NUL bytes in database and collection names

Composer arbitrary command execution via a malicious package's Perforce source URL

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

EasyAdmin custom-action dispatcher bypasses access_control on other routes

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

silverstripe/userforms vulnerable to remote code execution via userforms email subject

phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Winter: Authenticated backend users can bypass Users controller permission checks

Winter: Stored XSS through Editor Settings custom styles

Winter: Stored XSS through Brand Settings custom styles

Craft CMS: Authenticated RCE through Twig sandbox escape

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Statamic: Account takeover via OAuth email matching without email-verification check

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Pheditor has an authenticated terminal command whitelist bypass