Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.17 · >= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:35:43
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.17 · >= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:35:36
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.17 · >= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:35:31
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
GitHub

craftcms/craft

>= 5.0.0-RC1, <= 5.8.21 · >= 3.5.0, <= 4.16.17

2026-02-09 20:35:24
Craft CMS Vulnerable to Stored XSS in Entry Types Name
GitHub

craftcms/cms

>= 5.0.0-RC1, <= 5.8.21

2026-02-09 20:35:11
OpenSTAManager has a SQL Injection in the Prima Nota module
GitHub

devcode-it/openstamanager

<= 2.9.8

2026-02-06 18:25:56
OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module
GitHub

devcode-it/openstamanager

<= 2.9.8

2026-02-06 18:24:11
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
GitHub

devcode-it/openstamanager

< 2.9.8

2026-02-06 18:23:15
OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
GitHub

devcode-it/openstamanager

<= 2.9.8

2026-02-06 18:19:51
OpenSTAManager has a SQL Injection in Scadenzario Print Template
GitHub

devcode-it/openstamanager

<= 2.9.8

2026-02-06 18:06:14
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
GitHub

devcode-it/openstamanager

<= 2.9.8

2026-02-06 18:04:33
OpenSTAManager has an OS Command Injection in P7M File Processing
GitHub

devcode-it/openstamanager

<= 2.9.8

2026-02-06 17:59:37
MineAdmin May Expose Sensitive Information to an Unauthorized Actor
GitHub

mineadmin/mineadmin

>= 1.0.0, <= 2.0.3

2026-02-05 22:01:10
MineAdmin May Expose Sensitive Information to an Unauthorized Actor
GitHub

mineadmin/mineadmin

>= 1.0.0, <= 2.0.3

2026-02-05 22:00:45
MineAdmin has Incorrect Privilege Assignment
GitHub

mineadmin/mineadmin

>= 1.0.0, <= 2.0.3

2026-02-05 22:00:29
Microweber Cross-site Scripting vulnerability
GitHub

microweber/microweber

< 2.0.20

2026-02-05 21:51:36
Microweber has a Cross-site Scripting vulnerability
GitHub

microweber/microweber

< 2.0.20

2026-02-05 21:50:28
MineAdmin improperly refreshes tokens
GitHub

mineadmin/mineadmin

>= 1.0.0, <= 2.0.3 · <= 2.0.3

2026-02-05 21:45:18
Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager
GitHub

winter/wn-cms-module

<= 1.2.9

2026-02-04 21:32:40
PrestaShop affected by time based enumeration in FO login form
GitHub

prestashop/prestashop

>= 9.0.0-alpha.1, < 9.0.3 · < 8.2.4

2026-02-03 21:13:03
Moodle vulnerable to Cross-site Scripting
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.12 · >= 5.1.0-beta, < 5.1.1 · >= 5.0.0-beta, < 5.0.4 · >= 4.5.0-beta, < 4.5.8 · < 4.1.22

2026-02-03 19:36:42
Moodle Inserts Sensitive Information Into Sent Data
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.12 · >= 5.1.0-beta, < 5.1.1 · >= 5.0.0-beta, < 5.0.4 · >= 4.5.0-beta, < 4.5.8 · < 4.1.22

2026-02-03 19:17:12
Moodle has an authorization logic flaw
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.12 · >= 5.1.0-beta, < 5.1.1 · >= 5.0.0-beta, < 5.0.4 · >= 4.5.0-beta, < 4.5.8 · < 4.1.22

2026-02-03 19:16:53
Moodle authentication bypass vulnerability
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.12 · >= 5.1.0-beta, < 5.1.1 · >= 5.0.0-beta, < 5.0.4 · >= 4.5.0-beta, < 4.5.8 · < 4.1.22

2026-02-03 19:16:27
Moodle Affected by Improper Restriction of Excessive Authentication Attempts
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.12 · >= 5.1.0-beta, < 5.1.1 · >= 5.0.0-beta, < 5.0.4 · >= 4.5.0-beta, < 4.5.8 · < 4.1.22

2026-02-03 19:15:23
Moodle Open Redirect vulnerability
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.12 · >= 5.1.0-beta, < 5.1.1 · >= 5.0.0-beta, < 5.0.4 · >= 4.5.0-beta, < 4.5.8 · < 4.1.22

2026-02-03 19:07:09
Moodle formula injection vulnerability
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.12 · >= 5.1.0-beta, < 5.1.1 · >= 5.0.0-beta, < 5.0.4 · >= 4.5.0-beta, < 4.5.8 · < 4.1.22

2026-02-03 19:06:27
Moodle vulnerable to Cross-site Scripting
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.12 · >= 5.1.0-beta, < 5.1.1 · >= 5.0.0-beta, < 5.0.4 · >= 4.5.0-beta, < 4.5.8 · < 4.1.22

2026-02-03 19:05:27
Moodle Cross-site Scripting (XSS) vulnerability
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.12 · >= 5.1.0-beta, < 5.1.1 · >= 5.0.0-beta, < 5.0.4 · >= 4.5.0-beta, < 4.5.8 · < 4.1.22

2026-02-03 19:02:32
OpenSTAManager has an SQL Injection in the Stampe Module
GitHub

devcode-it/openstamanager

<= 2.9.8

2026-02-03 19:01:47
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
GitHub

devcode-it/openstamanager

<= 2.9.8

2026-02-03 18:44:20
FacturaScripts has SQL Injection in Autocomplete Actions
GitHub

facturascripts/facturascripts

< 2025.81

2026-02-03 18:17:25
FacturaScripts has SQL Injection in API ORDER BY Clause
GitHub

facturascripts/facturascripts

< 2025.81

2026-02-03 18:14:44
Subrion CMS vulnerable to cross-site scripting
GitHub

intelliants/subrion

<= 4.2.1

2026-02-03 18:04:03
LibreNMS contains an authenticated SQL Injection vulnerability
GitHub

librenms/librenms

<= 1.46

2026-02-02 23:19:10
Magento's X-Original-Url header can expose admin url
GitHub

openmage/magento-lts

< 20.16.1

2026-02-02 23:12:58
Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 23:04:01
Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 23:02:34
Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 23:00:13
Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:51:52
Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:51:17
Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
GitHub

craftcms/commerce

>= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:49:55
Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
GitHub

craftcms/composer

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0-RC1, <= 5.5.1

2026-02-02 22:45:03
Craft Commerce has Stored XSS in Product Type Name
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0, <= 5.5.1

2026-02-02 22:44:05
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0, <= 5.5.1

2026-02-02 22:43:01
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
GitHub

craftcms/commerce

>= 4.0.0-RC1, <= 4.10.0 · >= 5.0.0, <= 5.5.1

2026-02-02 22:41:44
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
GitHub

ci4-cms-erp/ci4ms

< 0.28.5.0

2026-02-02 21:52:59
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
GitHub

ci4-cms-erp/ci4ms

< 0.28.5.0

2026-02-02 21:52:09
RaspAP raspap-webgui contains an OS Command Injection vulnerability
GitHub

billz/raspap-webgui

< 3.3.6

2026-02-02 20:53:03
phpPgAdmin contains a remote command execution vulnerability
GitHub

phppgadmin/phppgadmin

<= 7.13.0

2026-02-02 20:33:48
« Previous Next »

Showing 251 to 300 of 5385 results

1 2 3 4 5 6 7 8 9 10 ... 107 108