Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
GitHub

phpmyfaq/phpmyfaq

<= 4.1.0

2026-04-01 22:31:44
phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController
GitHub

phpmyfaq/phpmyfaq

<= 4.1.0

2026-04-01 22:30:33
CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:09:41
CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:09:05
CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:08:30
CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:07:38
CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:07:15
CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:06:53
CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:06:28
CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:05:48
CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:04:54
CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:04:22
CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 22:03:42
CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 21:54:28
CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 21:53:01
AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:08:41
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:08:15
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:07:27
AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:06:58
AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:06:37
AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:06:00
AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:04:12
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification
GitHub

wwbn/avideo

<= 26.0

2026-04-01 20:54:52
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
GitHub

wwbn/avideo

<= 26.0

2026-04-01 20:54:08
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
GitHub

wwbn/avideo

<= 26.0

2026-04-01 20:48:55
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
GitHub

auth0/auth0-php

>= 8.0.0, <= 8.18.0

2026-04-01 20:29:27
OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2
GitHub

devcode-it/openstamanager

<= 2.10.1

2026-04-01 19:46:50
OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter
GitHub

devcode-it/openstamanager

<= 2.10.1

2026-04-01 19:46:02
YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities
GitHub

yeswiki/yeswiki

< 4.6.0

2026-04-01 00:24:13
YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter"
GitHub

yeswiki/yeswiki

< 4.6.0

2026-04-01 00:13:57
CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 00:10:01
CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
GitHub

ci4-cms-erp/ci4ms

<= 0.28.6.0

2026-04-01 00:09:24
AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel
GitHub

wwbn/avideo

<= 26.0

2026-03-31 23:22:22
AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php
GitHub

wwbn/avideo

<= 26.0

2026-03-31 23:21:51
AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking
GitHub

wwbn/avideo

<= 26.0

2026-03-31 23:15:26
Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
GitHub

j0k3r/graby

<= 2.5.0

2026-03-31 23:12:36
Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter
GitHub

admidio/admidio

<= 5.0.7

2026-03-31 23:11:50
Admidio has Missing CSRF Protection on Registration Approval Actions
GitHub

admidio/admidio

< 5.0.8

2026-03-31 23:11:25
Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php
GitHub

admidio/admidio

>= 5.0.0, <= 5.0.7

2026-03-31 23:10:41
Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess
GitHub

admidio/admidio

>= 5.0.0, < 5.0.8

2026-03-31 23:10:05
baserCMS is Vulnerable to Cross-site Scripting
GitHub

baserproject/basercms

<= 5.2.2

2026-03-31 22:52:08
phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor
GitHub

thorsten/phpmyfaq

<= 4.1.0

2026-03-31 22:48:47
baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API
GitHub

baserproject/basercms

<= 5.2.2

2026-03-31 22:47:39
baserCMS has OS command injection vulnerability in installer
GitHub

baserproject/basercms

<= 5.2.2

2026-03-31 22:43:32
baserCMS has a cross-site scripting vulnerability in blog posts
GitHub

baserproject/basercms

<= 5.2.2

2026-03-31 22:43:11
baserCMS has Mail Form Acceptance Bypass via Public API
GitHub

baserproject/basercms

<= 5.2.2

2026-03-31 22:36:21
baserCMS Update Functionality Vulnerable to OS Command Injection
GitHub

baserproject/basercms

<= 5.2.2

2026-03-31 22:35:47
baserCMS has an SQL injection vulnerability in its blog post functionality
GitHub

baserproject/basercms

<= 5.2.2

2026-03-31 22:35:11
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
GitHub

baserproject/basercms

<= 5.2.2

2026-03-31 22:27:06
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)
GitHub

baserproject/basercms

<= 5.2.2

2026-03-31 22:22:19
« Previous Next »

Showing 401 to 450 of 5833 results

1 2 ... 6 7 8 9 10 11 12 ... 116 117