Critical Composer (PHP) package vulnerabilities

CVE-2026-114509 · Composer (PHP)

Laravel TokenGuard authentication bypass through non-string API credentials

CVE-2026-107845 · Composer (PHP)

Contao: Cross-site scripting in the comments bundle

CVE-2026-92161 · Composer (PHP)

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

CVE-2026-45140 · Composer (PHP)

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

CVE-2026-75827 · Composer (PHP)

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

CVE-2026-75828 · Composer (PHP)

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

CVE-2026-79752 · Composer (PHP)

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

CVE-2026-77635 · Composer (PHP)

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

CVE-2026-84372 · Composer (PHP)

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

CVE-2026-55220 · Composer (PHP)

Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

CVE-2026-55634 · Composer (PHP)

Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

CVE-2026-59989 · Composer (PHP)

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

CVE-2026-54133 · Composer (PHP)

jmespath.php has CompilerRuntime code injection via unescaped function names

CVE-2026-62988 · Composer (PHP)

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

CVE-2026-63221 · Composer (PHP)

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

CVE-2026-63223 · Composer (PHP)

CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

GHSA-wg23-69c2-gjc8 · Composer (PHP)

Craft CMS: Passkey login accepts replayed WebAuthn assertions

CVE-2026-54588 · Composer (PHP)

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

GHSA-f25v-x6vr-962g · Composer (PHP)

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

CVE-2026-55579 · Composer (PHP)

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

CVE-2026-47156 · Composer (PHP)

MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

CVE-2026-52847 · Composer (PHP)

MantisBT: Reflected XSS in admin/install.php

CVE-2026-52881 · Composer (PHP)

MantisBT: Reflected XSS in admin/install.php via unescaped printf

CVE-2026-45262 · Composer (PHP)

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

CVE-2026-52824 · Composer (PHP)

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

GHSA-hgjx-r89m-m7v4 · Composer (PHP)

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

CVE-2026-47677 · Composer (PHP)

FacturaScripts: Account takeover of any 2FA-enabled user

CVE-2026-54159 · Composer (PHP)

prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

CVE-2026-52766 · Composer (PHP)

YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

CVE-2026-52777 · Composer (PHP)

YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize

CVE-2026-52778 · Composer (PHP)

YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

CVE-2026-27823 · Composer (PHP)

EGroupware has a Remote Code Execution Vulnerability

CVE-2026-52889 · Composer (PHP)

Formie Hidden field defaults vulnerable to Server-Side Template Injection

CVE-2026-9558 · Composer (PHP)

Mautic has Server-Side Template Injection (SSTI) in Theme Templates

CVE-2026-9559 · Composer (PHP)

Mautic vulnerable to Path Traversal via Campaign Import

CVE-2025-58048 · Composer (PHP)

Paymenter vulnerable to Remote Code Execution via public file uploads

CVE-2026-55791 · Composer (PHP)

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

CVE-2026-54003 · Composer (PHP)

Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

CVE-2026-55742 · Composer (PHP)

Cotonti: Cross-Site Request Forgery in the administration rights handler

CVE-2026-50886 · Composer (PHP)

Project Firefly III has incorrect access control in the webhook management component

CVE-2026-50887 · Composer (PHP)

shlink has a Server-Side Request Forgery issue

CVE-2026-48062 · Composer (PHP)

CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule

CVE-2026-48030 · Composer (PHP)

Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter

CVE-2026-45034 · Composer (PHP)

PHPSpreadsheet has a patch bypass for CVE-2026-34084

CVE-2026-47744 · Composer (PHP)

Shopper: Authorization bypass and RBAC privilege escalation in team settings

CVE-2026-54458 · Composer (PHP)

WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

CVE-2018-25357 · Composer (PHP)

Dolibarr ERP CRM contains a remote code evaluation vulnerability

CVE-2026-46670 · Composer (PHP)

YesWiki: Unauthenticated SQL Injection

CVE-2026-46633 · Composer (PHP)

Twig: PHP code injection via `{% use %}` template name

CVE-2026-8134 · Composer (PHP)

Concrete CMS Vulnerable to Relative Path Traversal

CVE-2026-9082 · Composer (PHP)

Drupal Core has a SQL Injection issue

CVE-2026-46725 · Composer (PHP)

TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)

CVE-2026-45697 · Composer (PHP)

Formie: Pre-authenticated server-side template injection in Hidden fields

GHSA-h29g-c9cx-c73q · Composer (PHP)

torrentpier has PHP Serialize Injections

CVE-2026-37709 · Composer (PHP)

Snipe-IT has insecure permissions in file uploads

CVE-2026-44212 · Composer (PHP)

PrestaShop has a stored XSS executable in customer service view

GHSA-gr3r-crp5-qrrm · Composer (PHP)

Compromised tag of intercom-php published via GitHub

CVE-2026-44262 · Composer (PHP)

Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules

CVE-2026-45010 · Composer (PHP)

phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

CVE-2026-46364 · Composer (PHP)

phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha

CVE-2026-42155 · Composer (PHP)

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

CVE-2026-42607 · Composer (PHP)

Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

CVE-2026-42613 · Composer (PHP)

Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access

GHSA-vj3m-2g9h-vm4p · Composer (PHP)

Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass

CVE-2026-42569 · Composer (PHP)

phpVMS has an /importer authorization bypass causing full database wipe

CVE-2026-34084 · Composer (PHP)

PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

CVE-2026-38992 · Composer (PHP)

Cockpit is vulnerable to arbitrary code execution

CVE-2026-41202 · Composer (PHP)

CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE

CVE-2026-41203 · Composer (PHP)

CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE

CVE-2026-23500 · Composer (PHP)

Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration

CVE-2026-31843 · Composer (PHP)

goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files

CVE-2026-41228 · Composer (PHP)

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution

CVE-2026-41229 · Composer (PHP)

Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

CVE-2026-40911 · Composer (PHP)

WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

CVE-2026-35035 · Composer (PHP)

CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

CVE-2026-34989 · Composer (PHP)

CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34557 · Composer (PHP)

CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34558 · Composer (PHP)

CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34559 · Composer (PHP)

CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34560 · Composer (PHP)

CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34561 · Composer (PHP)

CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34563 · Composer (PHP)

CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS

CVE-2026-34564 · Composer (PHP)

CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34565 · Composer (PHP)

CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34566 · Composer (PHP)

CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34567 · Composer (PHP)

CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34568 · Composer (PHP)

CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34569 · Composer (PHP)

CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34571 · Composer (PHP)

CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise

CVE-2026-21861 · Composer (PHP)

baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)

CVE-2026-30877 · Composer (PHP)

baserCMS Update Functionality Vulnerable to OS Command Injection

CVE-2026-30880 · Composer (PHP)

baserCMS has OS command injection vulnerability in installer

CVE-2026-27599 · Composer (PHP)

ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-33867 · Composer (PHP)

AVideo has Plaintext Video Password Storage

CVE-2026-33716 · Composer (PHP)

AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

CVE-2026-30849 · Composer (PHP)

MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

CVE-2026-33478 · Composer (PHP)

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

CVE-2026-33502 · Composer (PHP)

AVideo has Unauthenticated SSRF via plugin/Live/test.php

CVE-2026-33351 · Composer (PHP)

AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

CVE-2026-33352 · Composer (PHP)

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

CVE-2026-32817 · Composer (PHP)

Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion

CVE-2026-27591 · Composer (PHP)

Winter vulnerable to privilege escalation by authenticated backend users

CVE-2026-26279 · Composer (PHP)

Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

CVE-2026-27012 · Composer (PHP)

OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php

CVE-2026-28697 · Composer (PHP)

Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates

CVE-2026-29058 · Composer (PHP)

WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php

CVE-2026-28501 · Composer (PHP)

AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

CVE-2026-28502 · Composer (PHP)

AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

CVE-2026-28508 · Composer (PHP)

Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint

CVE-2026-27593 · Composer (PHP)

Statamic is vulnerable to account takeover via password reset link injection

CVE-2026-26016 · Composer (PHP)

Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

CVE-2026-26273 · Composer (PHP)

Known affected by Account Takeover via Password Reset Token Leakage

CVE-2025-69212 · Composer (PHP)

OpenSTAManager has an OS Command Injection in P7M File Processing

CVE-2026-25510 · Composer (PHP)

CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor

CVE-2026-23524 · Composer (PHP)

Laravel Redis Horizontal Scaling Insecure Deserialization

CVE-2025-67164 · Composer (PHP)

Pagekit CMS is vulnerable to OS Command Injection via Storage component

CVE-2025-67165 · Composer (PHP)

Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component

CVE-2025-66844 · Composer (PHP)

Grav may be vulnerable to SSRF attack via Twig Templates

CVE-2025-65854 · Composer (PHP)

MineAdmin has an insecure default password

CVE-2025-67719 · Composer (PHP)

Ibexa User Bundle is missing password change validation

CVE-2025-67510 · Composer (PHP)

Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)

GHSA-5j8p-438x-rgg5 · Composer (PHP)

SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475

CVE-2025-13828 · Composer (PHP)

Mautic user without privileged access to the Marketplace can install and uninstall composer packages

CVE-2025-61922 · Composer (PHP)

PrestaShop Checkout allows customer account takeover via email

CVE-2025-62417 · Composer (PHP)

bagisto has CSV Formula Injection in Create New Product

CVE-2025-10351 · Composer (PHP)

Melis Platform CMS SQL Injection

CVE-2025-10352 · Composer (PHP)

Melis Platform CMS Unauthenticated Admin Account Creation

CVE-2025-10353 · Composer (PHP)

Melis Platform CMS Unauthenticated File Upload Leading to RCE

CVE-2025-54236 · Composer (PHP)

Magento Community Edition Improper Input Validation vulnerability

CVE-2025-52122 · Composer (PHP)

The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability

CVE-2025-50706 · Composer (PHP)

ThinkPHP Path Traversal Vulnerability

CVE-2025-54119 · Composer (PHP)

The ADOdb sqlite3 driver allows SQL injection

CVE-2025-54418 · Composer (PHP)

CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

CVE-2025-54082 · Composer (PHP)

nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

CVE-2025-46001 · Composer (PHP)

simogeo/filemanager arbitrary file upload vulnerability

CVE-2025-54068 · Composer (PHP)

Livewire is vulnerable to remote command execution during component property update hydration

CVE-2025-53833 · Composer (PHP)

LaRecipe is vulnerable to Server-Side Template Injection attacks

CVE-2025-49132 · Composer (PHP)

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

CVE-2025-47110 · Composer (PHP)

Magneto contains stored XSS vulnerability

GHSA-98j6-67v3-mw34 · Composer (PHP)

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

GHSA-c42h-56wx-h85q · Composer (PHP)

laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

GHSA-862m-5253-832r · Composer (PHP)

Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

CVE-2025-48951 · Composer (PHP)

Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

CVE-2025-49113 · Composer (PHP)

Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

CVE-2025-48200 · Composer (PHP)

The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution

GHSA-2f4r-34m4-3w8q · Composer (PHP)

Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

GHSA-9fwj-9mjf-rhj3 · Composer (PHP)

laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

GHSA-9wg9-93h9-j8ch · Composer (PHP)

Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

CVE-2025-47275 · Composer (PHP)

Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK

CVE-2025-46337 · Composer (PHP)

SQL injection in ADOdb PostgreSQL driver pg_insert_id() method

CVE-2025-0520 · Composer (PHP)

ShowDoc unrestricted file upload vulnerability

CVE-2025-46348 · Composer (PHP)

YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

CVE-2025-32432 · Composer (PHP)

Craft CMS Allows Remote Code Execution

CVE-2025-32931 · Composer (PHP)

DevDojo Voyager Argument Injection vulnerability

CVE-2024-58136 · Composer (PHP)

yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

CVE-2025-22871 · Composer (PHP)

RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency

CVE-2025-27517 · Composer (PHP)

Volt Allows RCE Via User-Crafted Requests

CVE-2024-47051 · Composer (PHP)

Mautic allows Remote Code Execution and File Deletion in Asset Uploads

CVE-2024-57602 · Composer (PHP)

Easy!Appointments Improper Restriction of Excessive Authentication Attempts

GHSA-c2p2-hgjg-9r3f · Composer (PHP)

Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header

CVE-2025-24434 · Composer (PHP)

Improper Authorization vulnerability in Magento and Adobe Commerce

GHSA-vrpv-vw92-328g · Composer (PHP)

Multiple rtmpdump vulnerabilities

CVE-2025-25286 · Composer (PHP)

Crayfish allows Remote Code Execution via Homarus Authorization header

CVE-2024-50703 · Composer (PHP)

TeamPass privileges issue

CVE-2024-56145 · Composer (PHP)

Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

CVE-2021-3838 · Composer (PHP)

Deserialization of Untrusted Data in dompdf/dompdf

CVE-2021-3902 · Composer (PHP)

Improper Restriction of XML External Entity Reference in dompdf/dompdf

CVE-2024-51092 · Composer (PHP)

LibreNMS has an Authenticated OS Command Injection

CVE-2024-44902 · Composer (PHP)

ThinkPHP deserialization vulnerability

CVE-2024-37906 · Composer (PHP)

Admidio has Blind SQL Injection in ecard_send.php

CVE-2024-38529 · Composer (PHP)

Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

CVE-2024-41637 · Composer (PHP)

RaspAP allows an attacker to escalate privileges

CVE-2024-40624 · Composer (PHP)

TorrentPier Deserialization of Untrusted Data vulnerability

CVE-2024-37843 · Composer (PHP)

Craft CMS SQL injection vulnerability via the GraphQL API endpoint

CVE-2024-34102 · Composer (PHP)

Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability

CVE-2024-34103 · Composer (PHP)

Magento Open Source Improper Authentication vulnerability

GHSA-2x36-qhx3-7m5f · Composer (PHP)

ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select

GHSA-6fqw-j3vm-7f66 · Composer (PHP)

Zendframework1 Potential SQL injection in ORDER and GROUP functions

GHSA-8x2v-pcg7-94f4 · Composer (PHP)

Zend-JSON vulnerable to XXE/XEE attacks

GHSA-f4fj-q6m4-cc52 · Composer (PHP)

ZendFramework vulnerable to XXE/XEE attacks

GHSA-mhpx-3rv8-wrjm · Composer (PHP)

ZendFramework potential XML eXternal Entity injection vectors

GHSA-qc7w-4567-84wv · Composer (PHP)

Zendframework vulnerable to XXE/XEE attacks

GHSA-qf36-fx9f-232x · Composer (PHP)

ZendFramework potential SQL Injection Vector When Using PDO_MySql

GHSA-v42g-7q2x-cw32 · Composer (PHP)

Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)

GHSA-x86x-qhf8-f37w · Composer (PHP)

willdurand/js-translation-bundle potential path traversal attack and remote code injection

GHSA-67wg-6j7r-mqh8 · Composer (PHP)

Arbitrary Code Execution in TYPO3 CMS

GHSA-gwfx-p7mr-f92v · Composer (PHP)

Missing Access Check in TYPO3 CMS

GHSA-cc97-g92w-jm65 · Composer (PHP)

TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution

GHSA-j68w-pg49-f6vx · Composer (PHP)

Symfony XML decoding attack vector through external entities

GHSA-mmcv-fvq8-r9x3 · Composer (PHP)

Symfony XML decoding attack vector through external entities

GHSA-q3jm-v27q-jfww · Composer (PHP)

titon/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack

GHSA-4qpj-gxxg-jqg4 · Composer (PHP)

Swiftmailer Sendmail transport arbitrary shell execution

CVE-2024-5314 · Composer (PHP)

Dolibarr vulnerable to SQL Injection

CVE-2024-5315 · Composer (PHP)

Dolibarr vulnerable to SQL Injection

GHSA-8v6m-7f5v-hhx6 · Composer (PHP)

Silverstripe Brute force bypass on default admin

CVE-2024-25737 · Composer (PHP)

VuFind Server-Side Request Forgery (SSRF) vulnerability

CVE-2024-25738 · Composer (PHP)

VuFind Server-Side Request Forgery (SSRF) vulnerability

GHSA-7336-ghhp-f2qj · Composer (PHP)

Shopware Remote Code Execution Vulnerability

GHSA-83jv-4prm-34g7 · Composer (PHP)

Shopware Remote Code Execution Vulnerability

GHSA-q3g4-2vw9-xv27 · Composer (PHP)

Shopware Remote Code Execution Vulnerability

GHSA-7g7c-qhf3-x59p · Composer (PHP)

propel/propel1 SQL injection possible with limit() on MySQL

GHSA-7vw7-qx38-37vr · Composer (PHP)

Propel2 SQL injection possible with limit() on MySQL

GHSA-4rr6-gf59-ggw5 · Composer (PHP)

namshi/jose - Verification bypass

GHSA-rq6q-hjvh-5mwh · Composer (PHP)

Flow Swift Mailer package Remote code execution

CVE-2020-35125 · Composer (PHP)

Mautic is vulnerable to XSS vulnerability

GHSA-26hq-7286-mg8f · Composer (PHP)

Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability

GHSA-27qr-636m-wxg2 · Composer (PHP)

codeigniter/framework SQL injection in ODBC database driver

GHSA-2ffv-r4r9-r8xr · Composer (PHP)

Laravel RCE vulnerability in "cookie" session driver

GHSA-5gmh-85x8-5cx7 · Composer (PHP)

Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities

GHSA-6mgp-v5cm-ghg5 · Composer (PHP)

Drupal core Remote Code Execution

GHSA-6q9v-4hq6-5m67 · Composer (PHP)

Doctrine SQL injection vulnerability

GHSA-6wm4-3rjj-c8xx · Composer (PHP)

Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities

GHSA-7v68-3pr5-h3cr · Composer (PHP)

Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution

GHSA-8j7c-682x-r9f2 · Composer (PHP)

Magento RCE,XSS and other vulnerabilities

GHSA-9gxv-x7rp-r2hc · Composer (PHP)

gree/jose - "None" Algorithm treated as valid in tokens

GHSA-cv25-3pxr-4q7x · Composer (PHP)

Magento Open Source Security Advisory: Patch SUPEE-10975

GHSA-h533-5v22-8vcp · Composer (PHP)

firebase/php-jwt: "None" Algorithm treated as valid on tokens

GHSA-h63c-xvpf-264j · Composer (PHP)

ADOdb SQL injection vulnerability

GHSA-jf8c-36vw-98x4 · Composer (PHP)

Drupal core Remote Code Execution

GHSA-jjx7-8462-w4m4 · Composer (PHP)

Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution

GHSA-prpf-cj87-hwvr · Composer (PHP)

Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities

GHSA-qm5c-m76r-2hfr · Composer (PHP)

Laravel RCE vulnerability in "cookie" session driver

GHSA-wxxw-5gq6-j2g5 · Composer (PHP)

contao/core Insufficient input validation allows for code injection and remote execution

CVE-2024-34716 · Composer (PHP)

PrestaShop cross-site scripting via customer contact form in FO, through file upload

CVE-2024-4825 · Composer (PHP)

Cockpit CMS contains an arbitrary file upload vulenrability

CVE-2024-34070 · Composer (PHP)

Blind XSS Leading to Froxlor Application Compromise

CVE-2024-34461 · Composer (PHP)

Zenario uses Twig filters insecurely in the Twig Snippet plugin

GHSA-346h-749j-r28w · Composer (PHP)

PHPECC vulnerable to multiple cryptographic side-channel attacks

CVE-2014-8089 · Composer (PHP)

Zend Framework SQL injection vulnerability

CVE-2018-7602 · Composer (PHP)

Drupal Core Remote Code Execution Vulnerability

CVE-2024-31819 · Composer (PHP)

WWBN AVideo Remote Code Execution

CVE-2021-27312 · Composer (PHP)

Gleez Cms Server Side Request Forgery (SSRF) vulnerability

GHSA-97m3-52wr-xvv2 · Composer (PHP)

Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

CVE-2024-1651 · Composer (PHP)

Deserialization of Untrusted Data in Torrentpier

CVE-2024-25108 · Composer (PHP)

Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions

CVE-2024-22406 · Composer (PHP)

Blind SQL injection in shopware

CVE-2019-6342 · Composer (PHP)

Drupal Improper Access Control

CVE-2023-49599 · Composer (PHP)

WWBN AVideo Insufficient Entropy vulnerbaility

CVE-2023-46308 · Composer (PHP)

plotly.js prototype pollution vulnerability