Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

GrapesJsBuilder File Upload allows all file uploads
GitHub

mautic/grapes-js-builder-bundle

>= 4.0.0, < 4.4.18 · >= 6.0.0, < 6.0.7 · >= 5.0.0, < 5.2.9

2025-12-02 21:11:36
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
GitHub

mautic/core

>= 4.0.0, < 4.4.18 · >= 6.0.0, < 6.0.7 · >= 5.0.0, < 5.2.9

2025-12-02 21:10:41
FeehiCMS fails to enforce server-side immutability
GitHub

feehi/feehicms

= 2.1.1

2025-12-02 17:37:25
FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function
GitHub

feehi/feehicms

= 2.1.1

2025-12-02 17:37:20
Snipe-IT is vulnerable to stored cross-site scripting
GitHub

snipe/snipe-it

< 8.3.4

2025-12-02 16:54:42
FeehiCMS is vulnerable to reverse tabnabbing
GitHub

feehi/feehicms

<= 2.1.1

2025-12-02 16:52:52
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:25:35
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:25:16
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:24:56
Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:24:45
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:24:20
Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:23:20
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 01:23:05
Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:46:06
Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:39:02
Grav vulnerable to Path Traversal allowing server files backup
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:38:42
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:38:26
Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:37:40
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters
GitHub

getgrav/grav

< 1.11.0-beta.1

2025-12-02 00:37:15
Grav Exposes Password Hashes Leading to privilege escalation
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:37:10
Grav is vulnerable to a DOS on the admin panel
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:37:00
Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:36:52
Grav is vulnerable to Arbitrary File Read
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:36:45
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:36:36
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
GitHub

getgrav/grav

< 1.8.0-beta.27

2025-12-02 00:35:20
REDAXO CMS is vulnerable to XSS through its module management component
GitHub

redaxo/source

< 5.20.1

2025-11-26 22:00:54
REDAXO CMS is vulnerable to RCE attack through its template management component
GitHub

redaxo/source

< 5.20.1

2025-11-26 22:00:30
REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
GitHub

redaxo/source

< 5.20.1

2025-11-25 23:53:05
Contao is vulnerable to cross-site scripting in templates
GitHub

contao/core-bundle

>= 5.0.0-RC1, < 5.3.42 · >= 5.4.0-RC1, < 5.6.5 · >= 4.0.0, < 4.13.57

2025-11-25 20:48:14
Contao is vulnerable to remote code execution in template closures
GitHub

contao/core-bundle

>= 5.0.0-RC1, < 5.3.42 · >= 5.4.0-RC1, < 5.6.5 · >= 4.0.0, < 4.13.57

2025-11-25 20:43:14
Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags
GitHub

getformwork/formwork

< 2.2.0

2025-11-24 22:13:32
phppgadmin contains an incorrect access control vulnerability
GitHub

phppgadmin/phppgadmin

<= 7.13.0

2025-11-21 18:09:50
phppgadmin contains a SQL injection vulnerability
GitHub

phppgadmin/phppgadmin

<= 7.13.0

2025-11-21 18:07:13
phppgadmin contains a SQL injection vulnerability
GitHub

phppgadmin/phppgadmin

<= 7.13.0

2025-11-21 18:06:39
Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow
GitHub

snipe/snipe-it

<= 8.3.4

2025-11-20 21:56:35
phppgadmin vulnerable to Cross-site Scripting
GitHub

phppgadmin/phppgadmin

<= 7.13.0

2025-11-20 18:15:06
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
GitHub

devcode-it/openstamanager

<= 2.9.4

2025-11-19 21:00:40
MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory
GitHub

mongodb/mongodb-extension

< 1.21.2

2025-11-19 18:54:38
Drupal Email TFA allows Functionality Bypass
GitHub

drupal/email_tfa

< 2.0.6

2025-11-19 18:47:20
MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment
GitHub

munkireport/comment

>= 2.5.3, < 5.6.3 · < 4.1 · < 4.0 · < 2.6

2025-11-19 15:15:46
Backdrop CMS Host Header Injection vulnerability
GitHub

backdrop/backdrop

<= 1.32.0

2025-11-18 21:56:59
Drupal core allows Content Spoofing
GitHub

drupal/core

>= 11.2.0, < 11.2.8 · >= 11.0.0, < 11.1.9 · >= 10.5.0, < 10.5.6 · >= 8.0.0, < 10.4.9

2025-11-18 21:40:23
Drupal core allows Object Injection
GitHub

drupal/core

>= 11.2.0, < 11.2.8 · >= 11.0.0, < 11.1.9 · >= 10.5.0, < 10.5.6 · >= 8.0.0, < 10.4.9

2025-11-18 21:39:37
Drupal core allows Forceful Browsing
GitHub

drupal/core

>= 11.2.0, < 11.2.8 · >= 11.0.0, < 11.1.9 · >= 10.5.0, < 10.5.6 · >= 8.0.0, < 10.4.9

2025-11-18 21:39:07
Drupal Simple multi step form allows Cross-Site Scripting
GitHub

drupal/simple_multistep

< 2.0.0

2025-11-18 21:21:32
LibreNMS has Weak Password Policy
GitHub

librenms/librenms

< 25.11.0

2025-11-18 18:24:29
LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`
GitHub

librenms/librenms

< 25.11.0

2025-11-18 18:21:29
Kirby CMS has cross-site scripting (XSS) in the changes dialog
GitHub

getkirby/cms

>= 5.0.0, < 5.1.4

2025-11-18 18:01:26
phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
GitHub

thorsten/phpmyfaq

<= 4.0.13

2025-11-17 17:37:38
TYPO3 Modules Extension has Improper Authentication vulnerability
GitHub

codingms/modules

>= 7.0.0, < 7.5.5 · >= 6.0.0, < 6.4.2 · >= 5.0.0, < 5.7.4 · < 4.3.11

2025-11-14 20:46:32
« Previous Next »

Showing 401 to 450 of 5385 results

1 2 ... 6 7 8 9 10 11 12 ... 107 108