Advisories

Listing reported advisories sorted by their report date.

AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
GitHub

azuracast/azuracast

<= 0.23.1

2025-12-11 17:01:14
Ibexa User Bundle is missing password change validation
GitHub

ibexa/user

>= 5.0.0-beta1, < 5.0.4

2025-12-10 18:20:59
Shopware Storefront Reflected XSS in Storefront Login Page
GitHub

shopware/shopware

>= 6.4.6.0, < 6.6.10.10 · >= 6.7.0.0, < 6.7.5.1

2025-12-09 17:24:23
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
GitHub

onelogin/php-saml

>= 4.0.0, < 4.3.1 · >= 3.0.0, < 3.8.1 · < 2.21.1

2025-12-09 17:24:13
Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)
GitHub

neuron-core/neuron-ai

<= 2.8.11

2025-12-09 17:19:43
Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE)
GitHub

neuron-core/neuron-ai

<= 2.8.11

2025-12-09 17:19:24
Filament multi-factor authentication (app) recovery codes can be used multiple times
GitHub

filament/filament

>= 4.0.0, < 4.3.1

2025-12-09 17:19:12
yungifez Skuul School Management System vulnerable to XSS via SVG
GitHub

yungifez/skuul

<= 2.6.5

2025-12-08 22:16:12
robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation
GitHub

robrichards/xmlseclibs

<= 3.1.3

2025-12-08 17:57:35
LibreNMS Arbitrary File Read
GitHub

librenms/librenms

< 2017-08-18 · < 1.31

2025-12-05 21:03:48
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
GitHub

alexusmai/laravel-file-manager

<= 3.3.1

2025-12-05 18:58:08
LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint
GitHub

librenms/librenms

<= 25.10.0

2025-12-05 18:31:54
alexusmai laravel-file-manager is vulnerable to Directory Traversal
GitHub

alexusmai/laravel-file-manager

<= 3.3.1

2025-12-05 02:13:02
FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management
GitHub

feehi/cms

<= 2.1.1

2025-12-03 16:59:22
Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor
GitHub

getgrav/grav

<= 1.7.49

2025-12-03 14:18:29
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
GitHub

aimeos/ai-cms-grapesjs

>= 2023.04.1, < 2023.10.15 · >= 2025.04.1, < 2025.10.2 · >= 2024.04.1, < 2024.10.8 · >= 2022.04.1, < 2022.10.9 · >= 2021.04.1, < 2021.10.8

2025-12-03 14:05:28
Snipe-IT allows stored XSS via the Locations "Country" field
GitHub

snipe/snipe-it

< 8.3.4

2025-12-03 13:57:47
GrapesJsBuilder File Upload allows all file uploads
GitHub

mautic/grapes-js-builder-bundle

>= 4.0.0, < 4.4.18 · >= 6.0.0, < 6.0.7 · >= 5.0.0, < 5.2.9

2025-12-02 21:11:36
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
GitHub

mautic/core

>= 4.0.0, < 4.4.18 · >= 6.0.0, < 6.0.7 · >= 5.0.0, < 5.2.9

2025-12-02 21:10:41
FeehiCMS fails to enforce server-side immutability
GitHub

feehi/feehicms

= 2.1.1

2025-12-02 17:37:25
FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function
GitHub

feehi/feehicms

= 2.1.1

2025-12-02 17:37:20
Snipe-IT is vulnerable to stored cross-site scripting
GitHub

snipe/snipe-it

< 8.3.4

2025-12-02 16:54:42
FeehiCMS is vulnerable to reverse tabnabbing
GitHub

feehi/feehicms

<= 2.1.1

2025-12-02 16:52:52
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:25:35
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:25:16
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:24:56
Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:24:45
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:24:20
Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:23:20
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:23:05
Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:46:06
Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:39:02
Grav vulnerable to Path Traversal allowing server files backup
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:38:42
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:38:26
Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:37:40
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters
GitHub

getgrav/grav

< 1.11.0-beta.1

2025-12-02 00:37:15
Grav Exposes Password Hashes Leading to privilege escalation
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:37:10
Grav is vulnerable to a DOS on the admin panel
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:37:00
Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:36:52
Grav is vulnerable to Arbitrary File Read
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:36:45
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:36:36
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:35:20
REDAXO CMS is vulnerable to XSS through its module management component
GitHub

redaxo/source

< 5.20.1

2025-11-26 22:00:54
REDAXO CMS is vulnerable to RCE attack through its template management component
GitHub

redaxo/source

< 5.20.1

2025-11-26 22:00:30
REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
GitHub

redaxo/source

< 5.20.1

2025-11-25 23:53:05
Contao is vulnerable to cross-site scripting in templates
GitHub

contao/core-bundle

>= 5.0.0-RC1, < 5.3.42 · >= 5.4.0-RC1, < 5.6.5 · >= 4.0.0, < 4.13.57

2025-11-25 20:48:14
Contao is vulnerable to remote code execution in template closures
GitHub

contao/core-bundle

>= 5.0.0-RC1, < 5.3.42 · >= 5.4.0-RC1, < 5.6.5 · >= 4.0.0, < 4.13.57

2025-11-25 20:43:14
Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags
GitHub

getformwork/formwork

< 2.2.0

2025-11-24 22:13:32
phppgadmin contains an incorrect access control vulnerability
GitHub

phppgadmin/phppgadmin

<= 7.13.0

2025-11-21 18:09:50
phppgadmin contains a SQL injection vulnerability
GitHub

phppgadmin/phppgadmin

<= 7.13.0

2025-11-21 18:07:13
« Previous Next »

Showing 1 to 50 of 6380 results

1 2 3 4 5 6 7 8 9 10 ... 127 128