Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

Moodle course access permissions are not properly checked in course_output_fragment_course_overview
GitHub

moodle/moodle

>= 5.0.0-beta, < 5.0.3

2025-10-24 20:59:28
Moodle sends quiz-related messages to inactive/suspended users
GitHub

moodle/moodle

>= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7

2025-10-24 20:59:23
Moodle exposed the names of hidden groups to users
GitHub

moodle/moodle

>= 4.2.0-beta, < 4.4.11 · >= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7 · < 4.1.21

2025-10-24 20:59:13
Moodle has a time restriction bypass
GitHub

moodle/moodle

>= 4.2.0-beta, < 4.4.11 · >= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7 · < 4.1.21

2025-10-24 20:58:54
Moodle's error handling leads to sensitive information disclosure
GitHub

moodle/moodle

>= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7

2025-10-24 20:58:33
Moodle vulnerable to brute-force password guesses
GitHub

moodle/moodle

>= 4.2.0-beta, < 4.4.11 · >= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7 · < 4.1.21

2025-10-24 20:58:13
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
GitHub

spiral/roadrunner

< 2025.1.0

2025-10-24 20:57:41
Moodle does not properly enforce MFA
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.11 · >= 5.0.0-beta, < 5.0.3 · >= 4.5.0-beta, < 4.5.7

2025-10-24 17:43:17
Magento Improper Access Control Leads to Privilege escalation
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:23:23
Magento Improper Authorization leads to Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:23:18
Magento Improper Authorization leads to Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:23:15
Magento Improper Authorization Leading to Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:23:00
Magento Improper Access Control Leads to Privilege escalation
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:22:55
Magento Improper Authorization leads to security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:22:42
Magento does not properly protect credentials
GitHub

magento/project-community-edition

>= 2.4.8-beta1, < 2.4.8-beta2 · >= 2.4.7-beta1, < 2.4.7-p5 · >= 2.4.6-p1, < 2.4.6-p10 · >= 2.4.5-p1, < 2.4.5-p12 · < 2.4.4-p13 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:22:10
Magento Improper Access Control leads to Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.8-beta1, < 2.4.8-beta2 · >= 2.4.7-beta1, < 2.4.7-p5 · >= 2.4.6-p1, < 2.4.6-p10 · >= 2.4.5-p1, < 2.4.5-p12 · < 2.4.4-p13 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 22:22:05
Magento Improper Access Control leads to Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.8-beta1, < 2.4.8-beta2 · >= 2.4.7-beta1, < 2.4.7-p5 · >= 2.4.6-p1, < 2.4.6-p10 · >= 2.4.5-p1, < 2.4.5-p12 · < 2.4.4-p13 · <= 2.0.2 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-10-23 20:49:34
Magento Improper Access Control leads to security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p6 · >= 2.4.6-p1, < 2.4.6-p11 · < 2.4.5-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 21:29:28
Magento Improper Authorization leading to security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p6 · >= 2.4.6-p1, < 2.4.6-p11 · < 2.4.5-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 21:29:23
Magento Authenticated Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p6 · >= 2.4.6-p1, < 2.4.6-p11 · < 2.4.5-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 21:29:18
Magento Security feature bypass
GitHub

magento/project-community-edition

>= 2.4.7-beta1, < 2.4.7-p6 · >= 2.4.6-p1, < 2.4.6-p11 · < 2.4.5-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 21:04:01
Magento Cross-Site Request Forgery (CSRF) vulnerability
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha2 · >= 2.4.8-beta1, < 2.4.8-p2 · >= 2.4.7-beta1, < 2.4.7-p7 · >= 2.4.6-p1, < 2.4.6-p12 · < 2.4.5-p14 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 20:55:36
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha2 · >= 2.4.8-beta1, < 2.4.8-p2 · >= 2.4.7-beta1, < 2.4.7-p7 · >= 2.4.6-p1, < 2.4.6-p12 · < 2.4.5-p14 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-22 20:53:37
Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality
GitHub

admidio/admidio

<= 4.3.16

2025-10-22 16:46:05
code16 Sharp vulnerable to Cross Site Scripting (XSS)
GitHub

code16/sharp

< 9.7.0

2025-10-21 22:22:39
Magento vulnerable to path traversal
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha2 · >= 2.4.8-beta1, < 2.4.8-p2 · >= 2.4.7-beta1, < 2.4.7-p7 · >= 2.4.6-p1, < 2.4.6-p12 · < 2.4.5-p14 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-21 21:37:11
Magento has incorrect authorization issue that leads to arbitrary file system read
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha2 · >= 2.4.8-beta1, < 2.4.8-p2 · >= 2.4.7-beta1, < 2.4.7-p7 · >= 2.4.6-p1, < 2.4.6-p12 · < 2.4.5-p14 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-21 21:37:01
Magento vulnerable to denial of service
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha2 · >= 2.4.8-beta1, < 2.4.8-p2 · >= 2.4.7-beta1, < 2.4.7-p7 · >= 2.4.6-p1, < 2.4.6-p12 · < 2.4.5-p14 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6 · = 2.4.5

2025-10-21 21:27:52
Magento vulnerable to stored Cross-Site Scripting (XSS)
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha3 · >= 2.4.8-beta1, < 2.4.8-p3 · >= 2.4.7-beta1, < 2.4.7-p8 · < 2.4.6-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6

2025-10-21 21:04:39
ProcessWire CMS vulnerable to resource-exhaustion Denial of Service
GitHub

processwire/processwire

<= 3.0.246

2025-10-21 21:04:23
Magento vulnerable to stored Cross-Site Scripting (XSS)
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha3 · >= 2.4.8-beta1, < 2.4.8-p3 · >= 2.4.7-beta1, < 2.4.7-p8 · < 2.4.6-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6

2025-10-21 20:57:35
Magento vulnerable to privilege escalation due to incorrect authorization
GitHub

magento/project-community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha3 · >= 2.4.8-beta1, < 2.4.8-p3 · >= 2.4.7-beta1, < 2.4.7-p8 · < 2.4.6-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6

2025-10-21 20:49:44
Magento provides incorrect authorization through a security feature bypass
GitHub

magento/community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha3 · >= 2.4.8-beta1, < 2.4.8-p3 · >= 2.4.7-beta1, < 2.4.7-p8 · < 2.4.6-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6

2025-10-21 20:35:58
Shopware Customer Orders can be canceled, even if refunds are disabled
GitHub

shopware/platform

>= 6.7.0.0, < 6.7.3.1 · < 6.6.10.7

2025-10-21 18:03:28
Shopware exposes sensitive user information via CSV export mapping
GitHub

shopware/platform

>= 6.7.0.0, < 6.7.3.1 · < 6.6.10.7

2025-10-21 18:03:17
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice
GitHub

shopware/platform

>= 6.7.0.0, < 6.7.3.1 · < 6.6.10.7

2025-10-21 18:02:53
Shopware vulnerable to path traversal via Plugin upload
GitHub

shopware/platform

>= 6.7.0.0, < 6.7.3.1 · < 6.6.10.7

2025-10-21 18:02:15
Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually
GitHub

shopware/platform

>= 6.7.0.0, < 6.7.3.1 · < 6.6.10.7

2025-10-21 18:02:02
Magento allows incorrect authorization
GitHub

magento/community-edition

>= 2.4.9-alpha1, < 2.4.9-alpha3 · >= 2.4.8-beta1, < 2.4.8-p3 · >= 2.4.7-beta1, < 2.4.7-p8 · < 2.4.6-p13 · <= 2.0.2 · = 2.4.8 · = 2.4.7 · = 2.4.6

2025-10-20 21:05:55
TastyIgniter vulnerable to Cross-Site Scripting
GitHub

tastyigniter/tastyigniter

<= 3.7.7

2025-10-20 20:04:19
Cargo Mediawiki Extension vulnerable to Cross-site Scripting
GitHub

mediawiki/cargo

< 3.8.3

2025-10-20 17:55:00
Citizen vulnerable to stored XSS in sticky header button messages
GitHub

starcitizentools/citizen-skin

>= 3.3.0, < 3.9.0

2025-10-20 15:31:07
ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text
GitHub

ibexa/fieldtype-richtext

>= 4.6.0, < 4.6.25 · >= 5.0.0, < 5.0.3

2025-10-17 18:05:10
ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal
GitHub

ibexa/admin-ui

>= 4.6.0, < 4.6.25 · >= 5.0.0, < 5.0.3

2025-10-17 17:59:32
ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal
GitHub

ezsystems/ezplatform-admin-ui

>= 2.3.0, < 2.3.39

2025-10-17 17:58:47
ibexa/user login enumerates user accounts
GitHub

ibexa/user

>= 5.0.0, < 5.0.3

2025-10-17 17:58:09
PrestaShop Checkout allows customer account takeover via email
GitHub

prestashop/ps_checkout

>= 5.0.0, < 5.0.5 · >= 1.3.0, < 4.4.1 · < 4.4.1

2025-10-17 14:00:06
bagisto has Cross Site Scripting (XSS) in Create New Customer
GitHub

bagisto/bagisto

<= 2.3.7

2025-10-16 20:48:48
bagisto has CSV Formula Injection in Create New Product
GitHub

bagisto/bagisto

<= 2.3.7

2025-10-16 20:48:12
bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)
GitHub

bagisto/bagisto

<= 2.3.7

2025-10-16 20:41:04
« Previous Next »

Showing 1 to 50 of 4891 results

1 2 3 4 5 6 7 8 9 10 ... 97 98