Advisory Catalog

EasyAdmin custom-action dispatcher bypasses access_control on other routes

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Livewire DOM-based cross-site scripting during client-side state handling

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Kirby: Access to image files outside of the site root via path traversal in the media handling

Kirby: File upload permissions are not checked during processing of chunk data

Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

silverstripe/versioned has XSS in archive admin restore

PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

mongodb: Reject "." and NUL bytes in database and collection names

silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template

cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

silverstripe/userforms vulnerable to remote code execution via userforms email subject

OpenSTAManager has HTML Injection in modules/utenti/edit.php

LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

cakephp/debug_kit: MailPreview contains unsafe reflection

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match

Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

CakePHP: SmtpTransport vulnerable to CRLF header injection

Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin

Winter: Reflected XSS through the search query parameter in the backend Table widget

Winter: CSRF through AJAX handler names reachable as backend page actions

Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

Winter: My Account preview exposes another backend user's profile by record ID

Winter: Stored XSS through Backend List widget image columns

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk