Advisories

Listing reported advisories sorted by their report date.

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:47:22
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:45:41
Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items
GitHub

invoiceninja/invoiceninja

< 5.13.4

2026-03-24 20:40:17
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
GitHub

craftcms/cms

>= 5.3.0, <= 5.9.13

2026-03-24 17:28:42
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.13 · >= 4.0.0-RC1, <= 4.17.7

2026-03-24 17:27:18
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.13 · >= 4.0.0-RC1, <= 4.17.7

2026-03-24 16:59:59
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.13 · >= 4.0.0-RC1, <= 4.17.7

2026-03-24 16:57:19
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.9.13 · >= 4.0.0-RC1, <= 4.17.7

2026-03-24 16:53:24
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
GitHub

craftcms/cms

>= 5.6.0, <= 5.9.12

2026-03-24 16:50:43
Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API
GitHub

froxlor/froxlor

<= 2.3.4

2026-03-24 16:49:23
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
GitHub

roadiz/documents

>= 2.6.0, < 2.6.28 · >= 2.4.0, < 2.5.44 · >= 2.7.0, < 2.7.9 · < 2.3.42

2026-03-23 21:43:19
Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information
GitHub

opensource-workshop/connect-cms

>= 2.0.0, <= 2.41.0 · <= 1.41.0

2026-03-23 20:39:11
Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature
GitHub

opensource-workshop/connect-cms

>= 2.0.0, <= 2.40.0 · <= 1.40.0

2026-03-23 20:38:17
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
GitHub

opensource-workshop/connect-cms

>= 2.0.0, <= 2.41.0 · <= 1.41.0

2026-03-23 20:36:51
Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin
GitHub

opensource-workshop/connect-cms

>= 2.0.0, <= 2.41.0 · <= 1.41.0

2026-03-23 20:36:16
Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View
GitHub

opensource-workshop/connect-cms

>= 2.35.0, < 2.41.1 · >= 1.35.0, < 1.41.1

2026-03-23 20:35:51
Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin
GitHub

opensource-workshop/connect-cms

>= 2.0.0, < 2.41.1 · < 1.41.1

2026-03-23 20:33:35
MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL
GitHub

mantisbt/mantisbt

< 2.28.1

2026-03-23 20:28:55
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
GitHub

wwbn/avideo

<= 26.0

2026-03-20 21:55:37
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
GitHub

wwbn/avideo

<= 26.0

2026-03-20 21:55:17
DreamFactory has a directory traversal
GitHub

dreamfactory/df-core

< 1.0.4

2026-03-20 21:53:21
AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
GitHub

wwbn/avideo

<= 26.0

2026-03-20 21:47:51
league/commonmark contains a XSS vulnerability in Attributes extension
GitHub

league/commonmark

>= 1.5.0, < 2.7.0 · < 2.7.0

2026-03-20 21:27:12
CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
GitHub

league/commonmark

>= 2.0.0, <= 2.8.0 · <= 2.8.0

2026-03-20 21:26:32
league/commonmark has an embed extension allowed_domains bypass
GitHub

league/commonmark

>= 2.3.0, <= 2.8.1 · <= 2.8.1

2026-03-20 21:25:32
AVideo has Unauthenticated SSRF via plugin/Live/test.php
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:57:57
AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:57:44
AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:56:52
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:56:38
AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:49:37
AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:49:25
AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:49:07
AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:47:20
AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:46:52
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:46:42
AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:44:12
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:44:04
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
GitHub

avideo/avideo

<= 26.0

2026-03-20 20:43:52
Statamic is vulnerable to account takeover via password reset link injection
GitHub

statamic/cms

>= 6.0.0-alpha.1, < 6.7.1 · >= 6.0.0-alpha.1, < 6.3.3 · < 5.73.10

2026-03-19 21:10:39
Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite
GitHub

yoast/duplicate-post

<= 4.5

2026-03-19 19:37:41
The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI
GitHub

johnbillion/query-monitor

< 3.20.4

2026-03-19 19:37:05
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
GitHub

wwbn/avideo

<= 26.0

2026-03-19 19:34:07
AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
GitHub

wwbn/avideo

<= 26.0

2026-03-19 19:25:54
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
GitHub

wwbn/avideo

<= 26.0

2026-03-19 19:13:30
AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php
GitHub

wwbn/avideo

<= 25.0

2026-03-19 17:25:37
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
GitHub

wwbn/avideo

<= 25.0

2026-03-19 17:25:32
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
GitHub

wwbn/avideo

<= 25.0

2026-03-19 17:12:20
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources
GitHub

wwbn/avideo

<= 25.0

2026-03-19 17:12:15
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
GitHub

wwbn/avideo

<= 25.0

2026-03-19 17:12:05
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
GitHub

wwbn/avideo

<= 25.0

2026-03-19 16:43:07
« Previous Next »

Showing 51 to 100 of 6751 results

1 2 3 4 5 6 7 8 9 10 ... 135 136