Advisory Catalog

Guzzle: Unbounded response cookies risk denial of service

Guzzle: Proxy-Authorization headers can be sent to origin servers

Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files

The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.

Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML with s

The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than `private://`. This vulnerability is mitigated by the fact that Drupal must be configured to use a contr

MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs

MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters

Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

Koel has SSRF through Authenticated Subsonic podcast feed URLs

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

MantisBT: REST API unauthorized Issue status change

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter

Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

TYPO3 CMS - Unrestricted File Upload in Form Framework

Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Snipe-IT has CSS Injection via `header_color` Setting

Snipe-IT has incorrect permission for legacy license checkin API

Snipe-IT's import created_by can be overwritten

Snipe-IT has a path traversal vulnerability via CSV import `image` field

Snipe-IT vulnerable to stored XSS via inline-served attachment

Snipe-IT has an authorization bypass on print inventory page

Snipe-IT has an Open Redirect After User Edit

Snipe-IT has CSV formula injection in Activity Report export

Snipe-IT has missing object-level authorization in Kits API

Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Snipe-IT vulnerable to stored XSS via Markdown custom field

Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

phpMyFAQ public FAQ APIs expose inactive FAQ content

phpMyFAQ has Potential Authenticated Path Traversal in PDF Export

Sylius: IDOR on Shop Payment Request API endpoints

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

Sylius: Cart FormComponent allows modification or deletion of an already-completed order

YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes

YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`

YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))

YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read