Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.16.16 · >= 5.0.0-RC1, <= 5.8.20

2026-01-05 17:42:32
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
GitHub

facturascripts/facturascripts

= 2025.43 · = 2025.41 · = 2025.11 · <= 2025.4

2026-01-02 22:51:53
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
GitHub

bagisto/bagisto

< 2.3.10

2026-01-02 22:51:43
Bagisto has IDOR in Customer Order Reorder Functionality
GitHub

bagisto/bagisto

< 2.3.10

2026-01-02 22:50:48
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
GitHub

bagisto/bagisto

< 2.3.10

2026-01-02 22:13:41
Bagisto SSTI vulnerability in type parameter can lead to RCE
GitHub

bagisto/bagisto

< 2.3.10

2026-01-02 21:56:03
Bagisto has HTML Filter Bypass that Enables Stored XSS
GitHub

bagisto/bagisto

< 2.3.10

2026-01-02 21:16:24
Bagisto Missing Authentication on Installer API Endpoints
GitHub

bagisto/bagisto

>= 2.3.0, < 2.3.10

2026-01-02 21:14:09
phpMyFAQ contains a CSV injection vulnerability
GitHub

thorsten/phpmyfaq

<= 3.1.12

2026-01-02 15:47:43
YOURLS is vulnerable to XSS through JSONP and Callback request parameters
GitHub

yourls/yourls

<= 1.10.2

2025-12-30 19:34:28
Composer is vulnerable to ANSI sequence injection
GitHub

composer/composer

>= 2.0.0, < 2.2.26 · >= 2.3.0, < 2.9.3

2025-12-30 17:44:12
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
GitHub

thorsten/phpmyfaq

>= 4.1.0-alpha, <= 4.1.0-beta.2 · < 4.0.16

2025-12-30 15:31:24
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”
GitHub

pterodactyl/panel

< 1.12.0

2025-12-30 15:13:54
phpMyFAQ has Stored XSS in user list via admin-managed display_name
GitHub

thorsten/phpmyfaq

>= 4.0.14, < 4.0.16

2025-12-29 22:12:35
Croogo CMS has a path traversal vulnerability
GitHub

croogo/croogo

<= 4.0.7

2025-12-26 23:21:17
Cadmium CMS has a background arbitrary file upload vulnerability
GitHub

cadmium-org/cadmium-cms

<= 0.4.9

2025-12-23 20:00:41
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability
GitHub

librenms/librenms

< 25.12.0

2025-12-23 18:19:16
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
GitHub

roundcube/roundcubemail

>= 1.6.0, < 1.6.11 · < 1.5.10

2025-12-22 18:41:27
AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue
GitHub

aws/aws-sdk-php

< 3.368.0

2025-12-18 18:52:36
Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
GitHub

pagekit/pagekit

<= 1.0.18

2025-12-18 15:39:07
Pagekit CMS is vulnerable to OS Command Injection via Storage component
GitHub

pagekit/pagekit

<= 1.0.18

2025-12-18 15:37:52
Dolibarr Application Home Page has HTML injection vulnerability
GitHub

dolibarr/dolibarr

>= 18.0.4, < 18.0.7 · = 18.0.4

2025-12-18 01:34:49
Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency
GitHub

auth0/wordpress

>= 5.0.0-BETA0, <= 5.4.0

2025-12-17 20:57:11
Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK
GitHub

auth0/symfony

>= 5.0.0, <= 5.5.0

2025-12-17 20:56:38
Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency
GitHub

auth0/login

>= 7.0.0, < 7.20.0

2025-12-17 20:55:52
Auth0-PHP SDK has Improper Audience Validation
GitHub

auth0/auth0-php

>= 8.0.0, < 8.18.0

2025-12-17 20:52:48
Grav is vulnerable to Stored XSS through authenticated user-edited content
GitHub

getgrav/grav

<= 1.7.49.5

2025-12-17 19:47:31
Grav may be vulnerable to SSRF attack via Twig Templates
GitHub

getgrav/grav

<= 1.7.49.5

2025-12-17 19:47:16
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
GitHub

altcha-org/altcha

< 1.3.1

2025-12-16 00:43:54
MineAdmin has an insecure default password
GitHub

mineadmin/mineadmin

<= 3.0.9

2025-12-12 22:13:24
Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images
GitHub

yungifez/skuul

<= 2.6.4

2025-12-12 16:52:28
FoF Pretty Mail has a server-side template injection vulnerability
GitHub

fof/pretty-mail

<= 1.1.2

2025-12-12 16:39:20
Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice
GitHub

yungifez/skuul

<= 2.6.4

2025-12-12 16:39:01
AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
GitHub

azuracast/azuracast

<= 0.23.1

2025-12-11 17:01:14
Ibexa User Bundle is missing password change validation
GitHub

ibexa/user

>= 5.0.0-beta1, < 5.0.4

2025-12-10 18:20:59
Shopware Storefront Reflected XSS in Storefront Login Page
GitHub

shopware/shopware

>= 6.4.6.0, < 6.6.10.10 · >= 6.7.0.0, < 6.7.5.1

2025-12-09 17:24:23
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
GitHub

onelogin/php-saml

>= 4.0.0, < 4.3.1 · >= 3.0.0, < 3.8.1 · < 2.21.1

2025-12-09 17:24:13
Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)
GitHub

neuron-core/neuron-ai

<= 2.8.11

2025-12-09 17:19:43
Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE)
GitHub

neuron-core/neuron-ai

<= 2.8.11

2025-12-09 17:19:24
Filament multi-factor authentication (app) recovery codes can be used multiple times
GitHub

filament/filament

>= 4.0.0, < 4.3.1

2025-12-09 17:19:12
yungifez Skuul School Management System vulnerable to XSS via SVG
GitHub

yungifez/skuul

<= 2.6.5

2025-12-08 22:16:12
robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation
GitHub

robrichards/xmlseclibs

<= 3.1.3

2025-12-08 17:57:35
LibreNMS Arbitrary File Read
GitHub

librenms/librenms

< 2017-08-18 · < 1.31

2025-12-05 21:03:48
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
GitHub

alexusmai/laravel-file-manager

<= 3.3.1

2025-12-05 18:58:08
LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint
GitHub

librenms/librenms

<= 25.10.0

2025-12-05 18:31:54
alexusmai laravel-file-manager is vulnerable to Directory Traversal
GitHub

alexusmai/laravel-file-manager

<= 3.3.1

2025-12-05 02:13:02
FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management
GitHub

feehi/cms

<= 2.1.1

2025-12-03 16:59:22
Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor
GitHub

getgrav/grav

<= 1.7.49

2025-12-03 14:18:29
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
GitHub

aimeos/ai-cms-grapesjs

>= 2023.04.1, < 2023.10.15 · >= 2025.04.1, < 2025.10.2 · >= 2024.04.1, < 2024.10.8 · >= 2022.04.1, < 2022.10.9 · >= 2021.04.1, < 2021.10.8

2025-12-03 14:05:28
Snipe-IT allows stored XSS via the Locations "Country" field
GitHub

snipe/snipe-it

< 8.3.4

2025-12-03 13:57:47
« Previous Next »

Showing 351 to 400 of 5385 results

1 2 ... 5 6 7 8 9 10 11 ... 107 108