Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross Site Scripting in thorsten/phpmyfaq CVE-2023-2427, GHSA-5xq3-7mw9-wj5p | Medium | 0.5% | 05 May, 2023 | Packagist thorsten/phpmyfaq |
Moodle External Control of File Name or Path vulnerability BIT-moodle-2023-30943, CVE-2023-30943, GHSA-22gj-8qj2-fj46 | Medium | 6.8% | 02 May, 2023 | Packagist moodle/moodle |
RosarioSIS vulnerable to CSV Injection CVE-2023-29918, GHSA-f8hp-grmr-pp7j | Medium | 2.2% | 02 May, 2023 | Packagist francoisjacquet/rosariosis |
phpMyFAQ vulnerable to Stored Cross-site Scripting CVE-2023-2428, GHSA-8595-6653-96p2 | Medium | 0.6% | 30 Apr, 2023 | Packagist thorsten/phpmyfaq |
Missing rate limit for password resets CVE-2023-28821, GHSA-ph6g-6v8w-8p6m | Medium | 0.7% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Stored cross site scripting in RSS displayer CVE-2023-28820, GHSA-fgxj-g7x3-85cq | Medium | 0.4% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names CVE-2023-28819, GHSA-474f-mcjv-pgrm | Medium | 0.6% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Stored cross site scripting on API integration CVE-2023-28477, GHSA-xfmj-r86m-j2hr | Medium | 0.6% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Stored cross site scripting on tags CVE-2023-28476, GHSA-2ggc-552c-rmqr | Medium | 0.5% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Reflected cross site scripting CVE-2023-28475, GHSA-vcpr-hm2m-gjjj | Medium | 0.6% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Stored cross site scripting on saved presets CVE-2023-28474, GHSA-2j26-j953-2rph | Medium | 0.6% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Concrete CMS missing secure cookie parameters CVE-2023-28472, GHSA-f55r-8rcv-mqcf | Medium | 0.6% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Stored cross site scripting via container name CVE-2023-28471, GHSA-9h33-5fxw-r2xv | Medium | 0.5% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Cross-site Scripting (XSS) in pimcore CVE-2023-2361, GHSA-9xg6-75mh-7x3f | Medium | 0.5% | 28 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in Conditions tab of Pricing Rules CVE-2023-2332, GHSA-r7mm-jx6h-hv7m | Medium | 0.4% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Arbitrary File Read in Admin JS CSS files CVE-2023-30852, GHSA-j5c3-r84f-9596 | Medium | 1.0% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in DataObject Classification Store CVE-2023-2343, GHSA-9q7q-r54q-3f3g | Medium | 0.4% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in Website Settings name field CVE-2023-2342, GHSA-2c67-p4xh-m34w | Medium | 0.4% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in Admin Login too many attempts notice CVE-2023-2341, GHSA-fq95-rx4q-qgg2 | Medium | 1.1% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in DataObject columns grid CVE-2023-2340, GHSA-g93x-fm2w-5pxw | Medium | 0.5% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in DataObject Any Getter grid operator CVE-2023-2339, GHSA-6fvf-x8c6-2f6j | Medium | 0.5% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Path Traversal in Asset "import from server" option CVE-2023-2336, GHSA-hg77-vx9v-f49x | Medium | 0.7% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition CVE-2023-2328, GHSA-2295-vh28-pphc | Medium | 0.4% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in pimcore via DataObject Class date fields CVE-2023-2327, GHSA-x9xj-pqmv-8jf7 | Medium | 0.4% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field CVE-2023-2323, GHSA-cjv6-w5hf-5wr6 | Medium | 0.5% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site Scripting (XSS) in Document Properties Parameter CVE-2023-2322, GHSA-476g-v7hf-cw5m | Medium | 0.6% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross-site scripting vulnerabilities in old version of bundled TinyMCE GHSA-wqm8-jx8r-8rcq | Medium | Not scored | 26 Apr, 2023 | Packagist silverstripe/admin |
Open redirect vulnerability on CMSSecurity relogin screen CVE-2023-22729, GHSA-fw84-xgm8-9jmv | Medium | 0.4% | 26 Apr, 2023 | Packagist silverstripe/framework |
Missing permission check of canView in GridFieldPrintButton CVE-2023-22728, GHSA-jh3w-6jp2-vqqm | Medium | 0.5% | 26 Apr, 2023 | Packagist silverstripe/framework |
Cross Site Scripting in CraftCMS CVE-2023-30177, GHSA-wv7j-rc2q-9j67 | Medium | 0.4% | 25 Apr, 2023 | Packagist craftcms/cms |
Cross-site Scripting in Backdrop CMS CVE-2023-31045, GHSA-3862-c622-v4fp | Medium | 0.5% | 24 Apr, 2023 | Packagist backdrop/backdrop |
Cross-site Scripting in thorsten/phpmyfaq CVE-2023-1875, GHSA-ch5w-2994-6h82 | Medium | 0.5% | 22 Apr, 2023 | Packagist thorsten/phpmyfaq |
Information exposure in microweber CVE-2023-2239, GHSA-h83h-77x2-6w6g | Medium | 0.5% | 22 Apr, 2023 | Packagist microweber/microweber |
Improper Input Validation in nyholm/psr7 GHSA-wjfc-pgfp-pv9c | Medium | Not scored | 21 Apr, 2023 | Packagist nyholm/psr7 |
Improper header validation in httpsoft/http-message GHSA-9jxr-mwpp-w643 | Medium | Not scored | 21 Apr, 2023 | Packagist httpsoft/http-message |
Shopware vulnerable to cross-site scripting (XSS) CVE-2022-48150, GHSA-mj9r-fpv3-rgfx | Medium | 0.6% | 21 Apr, 2023 | Packagist shopware/shopware |
RosarioSIS improper access control vulnerability CVE-2023-2202, GHSA-g66v-3v62-g375 | Medium | 0.5% | 21 Apr, 2023 | Packagist francoisjacquet/rosariosis |
AzuraCast/AzuraCast vulnerable to cross-site scripting CVE-2023-2191, GHSA-q55c-hmpf-6h2g | Medium | 0.5% | 20 Apr, 2023 | Packagist azuracast/azuracast |
Insecure header validation in slim/psr7 CVE-2023-30536, GHSA-q2qj-628g-vhfw | Medium | 0.7% | 17 Apr, 2023 | Packagist slim/psr7 |
alextselegidis/easyappointments Improper Access Control vulnerability CVE-2023-2104, GHSA-fc4g-f42p-7rhp | Medium | 0.4% | 15 Apr, 2023 | Packagist alextselegidis/easyappointments |
alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting CVE-2023-2103, GHSA-7m8r-gmc3-3p4v | Medium | 0.5% | 15 Apr, 2023 | Packagist alextselegidis/easyappointments |
alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting CVE-2023-2102, GHSA-j6qq-9939-9jv8 | Medium | 0.5% | 15 Apr, 2023 | Packagist alextselegidis/easyappointments |
nilsteampassnet/teampass vulnerable to stored cross-site scripting (XSS) CVE-2023-2021, GHSA-4h2q-84w7-4mhx | Medium | 0.4% | 13 Apr, 2023 | Packagist nilsteampassnet/teampass |
Microweber vulnerable to cross-site scripting (XSS) CVE-2023-2014, GHSA-f4g6-c47x-qhww | Medium | 0.5% | 13 Apr, 2023 | Packagist microweber/microweber |
yuan1994 tpAdmin vulnerable to Server-Side Request Forgery CVE-2023-1971, GHSA-qr7h-8pv2-xvx2 | Medium | 0.6% | 10 Apr, 2023 | Packagist yuan1994/tpadmin |
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via category field name parameter CVE-2023-1885, GHSA-xxm6-ff3x-v4vm | Medium | 0.5% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |
thorsten/phpmyfaq vulnerable to cross-site scripting (XSS) via stopword parameter CVE-2023-1884, GHSA-gmjj-g2rm-xwm7 | Medium | 0.4% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |
thorsten/phpmyfaq vulnerable to improper access control CVE-2023-1883, GHSA-2wjp-w7g7-h63q | Medium | 0.5% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via updatecategory parameter CVE-2023-1879, GHSA-m9qm-m5w5-9pgj | Medium | 0.5% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via HTML export CVE-2023-1756, GHSA-8p48-ghv5-7qq7 | Medium | 0.5% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |