Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

Easy!Appointments Denial of Service (DoS)
GitHub

alextselegidis/easyappointments

<= 1.5.1 · <= 1.4.3

2025-05-08 19:36:44
Koillection Cross Site Scripting vulnerability
GitHub

koillection/koillection

< 1.6.12

2025-05-08 19:28:57
Moodle Incorrect Authorization vulnerability
GitHub

moodle/moodle

>= 3.9.0-beta, < 3.9.1 · >= 3.8.0-beta, < 3.8.4 · >= 3.6.0-beta, < 3.7.7 · < 3.5.13

2025-05-08 17:35:52
Moodle vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
GitHub

moodle/moodle

>= 2.5.0-beta, < 2.5.3 · >= 2.4.0-beta, < 2.4.7 · < 2.3.10

2025-05-08 17:35:25
Craft CMS stores arbitrary content provided by unauthenticated users in session files
GitHub

craftcms/cms

>= 5.0.0-alpha.1, < 5.7.5 · < 4.15.3

2025-05-08 14:53:03
Showdoc Unauthenticated Access
GitHub

showdoc/showdoc

< 2.8.14 · < 2.4.2

2025-05-06 23:22:09
league/commonmark contains a XSS vulnerability in Attributes extension
GitHub

league/commonmark

< 2.7.0

2025-05-05 20:40:36
Grokability Snipe-IT has incorrect authorization for accessing asset information
GitHub

snipe/snipe-it

< 8.1.0

2025-05-05 19:57:24
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.14.12 · >= 5.0.0-RC1, <= 5.6.14

2025-05-05 19:35:38
October CMS Allows Unprotected SVG Rename in Media Manager
GitHub

october/system

< 3.7.5

2025-05-05 14:55:42
Magento Improper Authorization vulnerability
GitHub

magento/community-edition

>= 2.4.6-p1, < 2.4.6-p10 · >= 2.4.5-p1, < 2.4.5-p12 · >= 2.4.8-beta1, < 2.4.8 · >= 2.4.7-p1, < 2.4.7-p5 · < 2.4.4-p13 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2025-05-01 19:31:14
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
GitHub

adodb/adodb-php

<= 5.22.8

2025-05-01 13:59:51
ShowDoc unrestricted file upload vulnerability
GitHub

showdoc/showdoc

< 2.8.7

2025-04-30 17:31:59
YesWiki Stored XSS Vulnerability in Comments
GitHub

yeswiki/yeswiki

<= 4.5.3

2025-04-29 14:49:14
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
GitHub

yeswiki/yeswiki

<= 4.5.3

2025-04-29 14:45:44
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
GitHub

yeswiki/yeswiki

<= 4.5.3

2025-04-29 14:41:34
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
GitHub

yeswiki/yeswiki

<= 4.5.3

2025-04-29 14:38:14
Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting
GitHub

yeswiki/yeswiki

< 4.5.4

2025-04-29 14:37:09
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
GitHub

yeswiki/yeswiki

<= 4.5.3

2025-04-29 14:36:13
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
GitHub

yeswiki/yeswiki

<= 4.5.3

2025-04-29 14:35:23
Moodle allows IDOR when accessing the cohorts report
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 17:28:42
Moodle has an IDOR in messaging web service which allows access to some user details
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 17:28:37
Moodle's AJAX section delete does not respect course_can_delete_section()
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 17:28:22
Moodle has reflected Cross-site Scripting risk in policy tool
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 17:28:12
Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 17:27:51
Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 17:27:41
Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 17:27:19
Moodle has a CSRF risk in Brickfield tool's analysis request action
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 17:07:25
Moodle's mod_data edit/delete pages pass CSRF token in GET parameter
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 17:06:30
Moodle allows IDOR in RSS block, which allows access to additional RSS feeds
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 16:52:04
Moodle has a CSRF risk in user tours manager that allows tour duplication
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8 · < 4.1.18

2025-04-25 16:51:42
Moodle reveals student identities through assignment submissions search on anonymous submissions
GitHub

moodle/moodle

>= 4.5.0-beta, < 4.5.4

2025-04-25 16:35:48
Moodle makes some user data available before completing second factor with MFA enabled
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8

2025-04-25 16:35:20
Moodle shows hidden grades to users without permission on some grade reports
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.11 · >= 4.5.0-beta, < 4.5.3 · >= 4.4.0-beta, < 4.4.7 · < 4.1.17

2025-04-25 16:35:03
Moodle allows unauthenticated REST API user data exposure
GitHub

moodle/moodle

>= 4.5.0-beta, < 4.5.3

2025-04-25 16:31:48
Moodle self enrollment available before completing second factor with MFA enabled
GitHub

moodle/moodle

>= 4.3.0-beta, < 4.3.12 · >= 4.5.0-beta, < 4.5.4 · >= 4.4.0-beta, < 4.4.8

2025-04-25 16:30:58
Craft CMS Allows Remote Code Execution
GitHub

craftcms/cms

>= 4.0.0-RC1, <= 4.14.14 · >= 5.0.0-RC1, <= 5.6.16 · >= 3.0.0-RC1, <= 3.9.14

2025-04-25 15:02:55
Moodle reflected XSS via H5P error message
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2025-04-23 22:25:49
MetalGenix GeniXCMS vulnerable to SQL Injection
GitHub

genix/cms

<= 0.0.3

2025-04-23 02:24:12
Luracast Restler directory traversal vulnerability
GitHub

aoe/restler

< 3.1.0 · < 1.7.1

2025-04-23 02:22:52
OctoberCMS Cross-Site Scripting
GitHub

october/rain

< 1.0.426

2025-04-23 02:22:42
Laravel Starter Cross Site Scripting (XSS)
GitHub

nasirkhan/laravel-starter

< 11.11.0

2025-04-22 22:16:37
MantisBT vulnerable to CSRF and Open Redirect attacks
GitHub

mantisbt/mantisbt

>= 2.4.0, < 2.4.1 · >= 2.0.0, < 2.3.3 · < 1.3.11

2025-04-22 18:44:45
MODX Revolution XSS via HTTP Host header
GitHub

modx/revolution

< 2.5.7

2025-04-22 18:44:00
MODX Revolution cross-site scripting vulnerability
GitHub

modx/revolution

< 2.5.7

2025-04-22 18:43:52
MODX Revolution allows overwriting .htaccess
GitHub

modx/revolution

< 2.5.7

2025-04-22 18:43:40
MODX Revolution Reflected XSS
GitHub

modx/revolution

< 2.5.7

2025-04-22 18:43:10
MODX Revolution Directory Traversal Vulnerability
GitHub

modx/revolution

< 2.5.7

2025-04-22 18:43:00
MantisBT allows arbitrary password reset
GitHub

mantisbt/mantisbt

>= 1.3.0-rc.2, < 1.3.10 · >= 2.3.0, < 2.3.1 · >= 2.0.0, < 2.2.4

2025-04-22 17:43:35
TeamPass vulnerable to SQL Injection
GitHub

nilsteampassnet/teampass

< 2.1.25

2025-04-22 17:33:25
« Previous Next »

Showing 401 to 450 of 5020 results

1 2 ... 6 7 8 9 10 11 12 ... 100 101