Advisories

Listing reported advisories sorted by their report date.

ShowDoc has an Injection vulnerability
GitHub

showdoc/showdoc

< 3.8.1

2026-05-05 20:21:53
Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`
GitHub

openmage/magento-lts

<= 20.17.0

2026-05-05 20:11:22
Admidio has an incomplete fix for CVE-2026-32812 (SSRF)
GitHub

admidio/admidio

<= 5.0.8

2026-05-05 20:03:47
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs
GitHub

openmage/magento-lts

<= 20.17.0

2026-05-05 19:35:57
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:15:57
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:13:04
AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:11:34
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:08:46
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:07:10
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
GitHub

wwbn/avideo

<= 29.0

2026-05-05 18:58:14
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
GitHub

webonyx/graphql-php

<= 15.32.2

2026-05-05 17:24:58
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
GitHub

webonyx/graphql-php

< 15.32.2

2026-05-04 22:22:11
livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler
GitHub

mckenziearts/livewire-markdown-editor

< 1.3

2026-05-04 22:11:07
phpVMS has an /importer authorization bypass causing full database wipe
GitHub

nabeel/phpvms

< 7.0.6

2026-05-04 21:20:40
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
GitHub

azuracast/azuracast

<= 0.23.5

2026-05-04 21:19:55
AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration
GitHub

azuracast/azuracast

<= 0.23.5

2026-05-04 21:19:25
AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption
GitHub

azuracast/azuracast

<= 0.23.5

2026-05-04 21:18:25
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass
GitHub

azuracast/azuracast

<= 0.23.5

2026-05-04 21:17:46
AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload
GitHub

azuracast/azuracast

<= 0.23.5

2026-05-04 21:16:55
CI4MS has a Deactivated User Session Bypass (active=0)
GitHub

ci4-cms-erp/ci4ms

>= 0.26.0, <= 0.31.7.0

2026-05-04 20:50:57
CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess
GitHub

ci4-cms-erp/ci4ms

>= 0.31.1.0, <= 0.31.7.0

2026-05-04 20:50:12
Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
GitHub

getkirby/cms

>= 5.0.0, <= 5.3.3 · <= 4.8.0

2026-05-04 19:59:31
Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions
GitHub

getkirby/cms

>= 5.0.0, <= 5.3.3 · <= 4.8.0

2026-05-04 19:58:44
Kirby CMS's read access to site, user and role information is not gated by permissions
GitHub

getkirby/cms

>= 5.0.0, <= 5.3.3 · <= 4.8.0

2026-05-04 19:50:25
Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
GitHub

getkirby/cms

>= 5.0.0, <= 5.3.3 · <= 4.8.0

2026-04-30 21:03:23
ps_checkout allows unauthorized method invocation through unvalidated parameter
GitHub

prestashop/ps_checkout

< 5.3.0

2026-04-30 20:59:29
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:58:58
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:57:31
Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:56:13
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:54:32
Admidio Missing Minimum Administrator Check in Role Membership Removal
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:53:20
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:51:13
Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:49:25
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:47:29
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:46:23
Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:44:26
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:42:23
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
GitHub

admidio/admidio

<= 5.0.8

2026-04-29 21:37:25
ipl/web is vulnerable to reflected XSS by malformed search requests
GitHub

ipl/web

<= 0.13.0

2026-04-29 21:01:56
OpenID Connect nonce generated but never validated — ID token replay attack
GitHub

roadiz/openid

>= 2.7.0, < 2.7.18 · >= 2.6.0, < 2.6.31 · >= 2.5.0, < 2.5.45 · < 2.3.43

2026-04-29 20:51:43
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
GitHub

ci4-cms-erp/ci4ms

>= 0.26.0.0, <= 0.31.6.0

2026-04-29 20:42:45
Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions
GitHub

dolibarr/dolibarr

<= 22.0.4

2026-04-29 20:40:34
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
GitHub

phpoffice/phpspreadsheet

>= 3.3.0, <= 3.10.4 · >= 2.0.0, <= 2.1.15 · >= 4.0.0, <= 5.6.0 · >= 2.2.0, <= 2.4.4 · <= 1.30.3

2026-04-29 20:24:17
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
GitHub

phpoffice/phpspreadsheet

>= 3.3.0, <= 3.10.4 · >= 2.0.0, <= 2.1.15 · >= 4.0.0, <= 5.6.0 · >= 2.2.0, <= 2.4.4 · <= 1.30.3

2026-04-29 20:23:27
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
GitHub

phpoffice/phpspreadsheet

>= 3.3.0, <= 3.10.3 · >= 2.0.0, <= 2.1.14 · >= 4.0.0, <= 5.5.0 · >= 2.2.0, <= 2.4.3 · <= 1.30.2

2026-04-29 20:22:32
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
GitHub

phpoffice/phpspreadsheet

>= 3.3.0, <= 3.10.4 · >= 2.0.0, <= 2.1.15 · >= 4.0.0, <= 5.6.0 · >= 2.2.0, <= 2.4.4 · <= 1.30.3

2026-04-28 22:57:14
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
GitHub

phpoffice/phpspreadsheet

>= 3.3.0, <= 3.10.4 · >= 2.0.0, <= 2.1.15 · >= 4.0.0, <= 5.6.0 · >= 2.2.0, <= 2.4.4 · <= 1.30.3

2026-04-28 22:50:33
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field
GitHub

facturascripts/facturascripts

<= 2024.92.x-dev

2026-04-28 22:39:02
CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-27 16:26:11
Dolibarr Allows Code Injection through its Website Module
GitHub

dolibarr/dolibarr

<= 15.0.3

2026-04-25 23:27:12
« Previous Next »

Showing 301 to 350 of 7292 results

1 2 3 4 5 6 7 8 9 10 ... 145 146