Advisories

Listing reported advisories sorted by their report date.

Sylius Vulnerable to Authenticated Stored XSS
GitHub

sylius/sylius

>= 2.1.0, <= 2.1.11 · >= 2.0.0, <= 2.0.15 · >= 2.2.0, <= 2.2.2

2026-03-11 00:13:23
Sylius has a XSS vulnerability in checkout login form
GitHub

sylius/sylius

>= 2.1.0, <= 2.1.11 · >= 2.0.0, <= 2.0.15 · >= 2.2.0, <= 2.2.2

2026-03-11 00:13:03
Sylius is Missing Authorization in API v2 Add Item Endpoint
GitHub

sylius/sylius

>= 2.1.0, <= 2.1.11 · >= 2.0.0, <= 2.0.15 · >= 2.2.0, <= 2.2.2

2026-03-11 00:12:58
Sylius affected by IDOR in Cart and Checkout LiveComponents
GitHub

sylius/sylius

>= 2.1.0, <= 2.1.11 · >= 2.0.0, <= 2.0.15 · >= 2.2.0, <= 2.2.2

2026-03-11 00:12:48
Sylius has an Open Redirect via Referer Header
GitHub

sylius/sylius

>= 1.14.0, <= 1.14.17 · >= 1.13.0, <= 1.13.14 · >= 1.12.0, <= 1.12.22 · >= 1.11.0, <= 1.11.16 · >= 1.10.0, <= 1.10.15 · >= 2.1.0, <= 2.1.11 · >= 2.0.0, <= 2.0.15 · >= 2.2.0, <= 2.2.2 · <= 1.9.11

2026-03-11 00:12:33
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
GitHub

web-auth/webauthn-framework

>= 5.2.0, < 5.2.4 · < 5.2.4

2026-03-10 22:21:16
Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file
GitHub

wpmetabox/meta-box

< 5.11.2

2026-03-10 19:34:20
Craft Commerce: Potential IDOR in Commerce carts
GitHub

craftcms/commerce

>= 4.0.0, < 4.11.0 · >= 5.0.0, < 5.6.0

2026-03-10 18:24:50
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.1 · >= 5.0.0, <= 5.5.2

2026-03-10 18:24:20
Craft Commerce has stored XSS in Inventory Location Name
GitHub

craftcms/commerce

>= 5.0.0, <= 5.5.2

2026-03-10 18:24:00
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking
GitHub

craftcms/commerce

>= 5.0.0, <= 5.5.2

2026-03-10 18:23:43
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
GitHub

craftcms/commerce

>= 5.0.0, <= 5.5.2

2026-03-10 18:23:27
Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders Table
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.1 · >= 5.0.0, <= 5.5.2

2026-03-10 18:23:18
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
GitHub

craftcms/commerce

>= 4.0.0, <= 4.10.1 · >= 5.0.0, <= 5.5.2

2026-03-10 18:23:08
Craft CMS has a potential information disclosure vulnerability in preview tokens
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.3 · >= 5.0.0-RC1, < 5.9.6

2026-03-10 18:22:03
flarum/nicknames extension has display name injection in notification emails (autolink & markdown)
GitHub

flarum/nicknames

< 1.8.3

2026-03-10 00:56:30
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
GitHub

azuracast/azuracast

<= 0.23.3

2026-03-09 19:55:03
Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
GitHub

admidio/admidio

< 5.0.6

2026-03-09 19:45:22
Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book
GitHub

sylius/sylius

>= 1.12.0-alpha.1, < 1.12.16 · >= 1.11.0-alpha.1, < 1.11.17 · >= 1.10.0-alpha.1, < 1.10.16 · >= 1.13.0-alpha.1, < 1.13.1 · < 1.9.12

2026-03-09 15:57:34
Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel
GitHub

sylius/sylius

>= 1.12.0-alpha.1, < 1.12.16 · >= 1.11.0-alpha.1, < 1.11.17 · >= 1.10.0-alpha.1, < 1.10.16 · >= 1.13.0-alpha.1, < 1.13.1 · < 1.9.12

2026-03-09 15:56:14
Sylius has a security vulnerability via adjustments API endpoint
GitHub

sylius/sylius

>= 1.11.0-alpha.1, <= 1.11.16 · >= 1.10.0-alpha.1, <= 1.10.15 · >= 1.12.0-alpha.1, < 1.12.19 · >= 1.13.0-alpha.1, < 1.13.4 · < 1.12.19 · < 1.9.12

2026-03-09 15:54:22
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
GitHub

snipe/snipe-it

< 8.3.7

2026-03-07 02:33:41
AVideo has Unauthenticated IDOR - Playlist Information Disclosure
GitHub

wwbn/avideo

< 25.0

2026-03-07 02:25:49
Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)
GitHub

grumpydictator/firefly-iii

>= 6.4.23, <= 6.5.0

2026-03-07 02:10:45
EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface
GitHub

ec-cube/ec-cube

>= 4.1.0, <= 4.3.1

2026-03-05 21:14:58
Leantime has HTML injection through firstname and lastname fields
GitHub

leantime/leantime

< 3.3.0

2026-03-05 18:05:59
AVideo: Unauthenticated PHP session store exposed to host network via published memcached port
GitHub

wwbn/avideo

<= 21.0

2026-03-05 01:22:21
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
GitHub

concrete5/concrete5

< 9.4.8

2026-03-04 21:47:53
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
GitHub

concrete5/concrete5

< 9.4.8

2026-03-04 21:46:03
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
GitHub

concrete5/concrete5

< 9.4.8

2026-03-04 21:36:27
Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)
GitHub

concrete5/concrete5

< 9.4.8

2026-03-04 21:35:02
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
GitHub

concrete5/concrete5

< 9.4.8

2026-03-04 21:34:12
Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection
GitHub

concrete5/concrete5

< 9.4.8

2026-03-04 21:32:24
Craft CMS has unauthenticated activation email trigger with potential user enumeration
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.2 · >= 5.0.0-RC1, < 5.9.0-beta.2

2026-03-04 20:52:32
Kimai's API invoice endpoint missing customer-level access control (IDOR)
GitHub

kimai/kimai

<= 2.50.0

2026-03-04 20:43:19
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 21:06:45
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 21:05:15
Craft CMS has Twig Function Blocklist Bypass
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 21:01:30
Craft CMS: Entries Authorship Spoofing via Mass Assignment
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 21:00:55
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 21:00:20
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 20:58:09
Craft CMS has IDOR via GraphQL @parseRefs
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.0.0-RC1, < 5.9.0-beta.1

2026-03-03 20:38:57
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.17.0-beta.1 · >= 5.8.7, < 5.9.0-beta.1

2026-03-03 20:30:37
WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php
GitHub

wwbn/avideo

< 7.0.0

2026-03-03 20:02:43
OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php
GitHub

devcode-it/openstamanager

<= 2.9.8

2026-03-03 17:43:50
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
GitHub

froxlor/froxlor

<= 2.3.3

2026-03-03 17:40:19
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
GitHub

devcode-it/openstamanager

< 2.9.8

2026-03-03 17:39:02
Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
GitHub

idno/known

< 1.6.4

2026-03-02 21:26:25
Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint
GitHub

idno/known

<= 1.6.3

2026-03-02 21:24:38
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
GitHub

wwbn/avideo

< 21.0

2026-03-02 20:56:53
« Previous Next »

Showing 151 to 200 of 6751 results

1 2 3 4 5 6 7 8 9 10 ... 135 136