Advisory Catalog

PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter

Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel relationship inclusion can trigger unauthorized data destruction

Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit. This vulnerability is mitiga

Cachet has Stored XSS in Incident Component

react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the `adminis

The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.

YOURLS: Unauthenticated File Inclusion

A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Contao: Cross-site request forgery in custom backend actions

Contao: Improper access control in the preview links module

Contao: Improper access control in the table access voter

Contao: Cross-site scripting in the comments bundle

Contao: Path traversal in the images controller

Contao: The registration module re-sends activation mails

Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Filament: Multi-factor authentication (app) management actions do not require password reauthentication

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Laravel: XSS in Debug Page Information

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

zbateson/mail-mime-parser has CRLF header injection via attachment filename

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Snipe-IT: 2FA bypass via the API token flow

phpMyFAQ's two-factor authentication login bypasses the password factor

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission