Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-0310, GHSA-9jff-8xmm-mw22 | Medium | 0.6% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-0309, GHSA-25c3-7fvj-v45j | Medium | 0.5% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-0308, GHSA-w475-749h-c77m | Medium | 0.5% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-0306, GHSA-96x6-jf5w-84c5 | Medium | 0.6% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
Improper Authorization in grumpydictator/firefly-iii CVE-2023-0298, GHSA-7mc4-jp4f-v2j2 | Medium | 0.6% | 14 Jan, 2023 | Packagist grumpydictator/firefly-iii |
XML-RPC for PHP allows access to local files via malicious argument to the Client::send method GHSA-m95x-m25c-w9mp | Medium | Not scored | 11 Jan, 2023 | Packagist phpxmlrpc/phpxmlrpc |
XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument GHSA-7vcx-v65q-9wpg | Medium | Not scored | 11 Jan, 2023 | Packagist phpxmlrpc/phpxmlrpc |
XML-RPC for PHP's debugger vulnerable to possible XSS attack GHSA-pxqj-xrv5-qvjf | Medium | Not scored | 11 Jan, 2023 | Packagist phpxmlrpc/phpxmlrpc |
Flarum notifications can leak restricted content CVE-2023-22488, GHSA-8gcg-vwmw-rxj4 | Medium | 0.4% | 10 Jan, 2023 | Packagist flarum/core |
PocketMine-MP vulnerable to denial-of-service by sending large modal form responses CVE-2023-54395, GHSA-7m9r-rq9j-wmmh | Medium | 0.5% | 10 Jan, 2023 | Packagist pocketmine/pocketmine-mp |
Information Cards Module vulnerable to Cross-site Scripting CVE-2010-10004, GHSA-2phw-rgr7-5pvh | Medium | 0.5% | 09 Jan, 2023 | Packagist simplesamlphp/simplesamlphp-module-infocard |
Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy CVE-2016-15015, GHSA-vg5x-6q66-rvgx | Medium | 0.7% | 08 Jan, 2023 | Packagist barzahlen/barzahlen-php |
SUKOHI Surpass Path Traversal vulnerability CVE-2015-10030, GHSA-c9pw-f4wp-22jr | Medium | 0.8% | 08 Jan, 2023 | Packagist sukohi/surpass |
Symbiote Seed Open Redirect vulnerability CVE-2017-20164, GHSA-wm32-3r4m-jvcc | Medium | 0.5% | 07 Jan, 2023 | Packagist symbiote/silverstripe-seed |
Xataface vulnerable to Cross-site Scripting CVE-2021-4303, GHSA-64wv-c7jw-jw2q | Medium | 0.5% | 05 Jan, 2023 | Packagist xataface/xataface |
typo3-appointments vulnerable to Cross-site Scripting CVE-2019-25094, GHSA-cf5r-3pvm-w64w | Medium | 0.6% | 04 Jan, 2023 | Packagist innologi/typo3-appointments |
SimpleSAMLphp simplesamlphp-module-openid CVE-2010-10002, GHSA-ggj9-6x8j-49w9 | Medium | 0.7% | 01 Jan, 2023 | Packagist simplesamlphp/simplesamlphp-module-openid |
Yii2 FileAPI Widget vulnerable to Cross-site Scripting CVE-2017-20158, GHSA-j82x-fh8h-326g | Medium | 0.6% | 31 Dec, 2022 | Packagist vova07/yii2-fileapi-widget |
Froxlor Improper Authorization vulnerability CVE-2022-4868, GHSA-w6qf-j4qr-f946 | Medium | 0.7% | 31 Dec, 2022 | Packagist froxlor/froxlor |
Froxlor vulnerable to Cross-Site Request Forgery CVE-2022-4867, GHSA-6gwx-gw56-qhf7 | Medium | 0.4% | 31 Dec, 2022 | Packagist froxlor/froxlor |
Froxlor vulnerable to Argument Injection CVE-2022-4864, GHSA-3v7m-2jrh-vc93 | Medium | 0.5% | 30 Dec, 2022 | Packagist froxlor/froxlor |
Harvest Chosen vulnerable to Cross-site Scripting CVE-2018-25050, GHSA-x5q4-m45m-fm94 | Medium | 0.7% | 28 Dec, 2022 | Packagist harvesthq/chosen |
php-mod/curl allows Cross-site Scripting CVE-2021-30134, GHSA-f8p3-q834-q9cj | Medium | 1.3% | 26 Dec, 2022 | Packagist php-mod/curl |
Snipe-IT allows attackers to check whether a user account exists CVE-2022-44381, GHSA-qqv9-gqh5-7h99 | Medium | 0.7% | 25 Dec, 2022 | Packagist snipe/snipe-it |
Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets CVE-2022-44380, GHSA-363q-j92x-7543 | Medium | 0.5% | 25 Dec, 2022 | Packagist snipe/snipe-it |
Microweber vulnerable to Stored Cross-Site Scripting CVE-2022-4647, GHSA-9cmm-52cv-6hvc | Medium | 0.6% | 22 Dec, 2022 | Packagist microweber/microweber |
Microweber vulnerable to Reflected Cross-site Scripting CVE-2022-4617, GHSA-3mmh-vq9w-4c3g | Medium | 0.7% | 21 Dec, 2022 | Packagist microweber/microweber |
Roots Soil plugin vulnerable to Cross-site Scripting CVE-2022-4524, GHSA-jw6x-4h8h-569x | Medium | 0.6% | 15 Dec, 2022 | Packagist roots/soil |
FeehiCMS Cross Site Scripting vulnerability CVE-2022-40373, GHSA-xv8h-43h9-v3jq | Medium | 0.5% | 15 Dec, 2022 | Packagist feehi/feehicms |
FeehiCMS Cross Site Scripting vulnerability CVE-2022-40002, GHSA-6vh6-72g6-xqx2 | Medium | 0.5% | 15 Dec, 2022 | Packagist feehi/feehicms |
FeehiCMS Cross Site Scripting vulnerability CVE-2022-40001, GHSA-gqgq-784q-v9xp | Medium | 0.5% | 15 Dec, 2022 | Packagist feehi/feehicms |
FeehiCMS Cross Site Scripting vulnerability CVE-2022-40000, GHSA-8vjp-hfgh-68rj | Medium | 0.5% | 15 Dec, 2022 | Packagist feehi/feehicms |
FeehiCMS Unrestricted Upload vulnerability CVE-2021-36573, GHSA-67mh-hw8v-x8v9 | Medium | 0.5% | 15 Dec, 2022 | Packagist feehi/feehicms |
FeehiCMS Cross Site Scripting vulnerability CVE-2021-36572, GHSA-m54v-gv8p-9pqp | Medium | 0.4% | 15 Dec, 2022 | Packagist feehi/feehicms |
FeehiCMS Cross Site Scripting vulnerability CVE-2020-36607, GHSA-6jj8-mqx2-7fg5 | Medium | 0.7% | 15 Dec, 2022 | Packagist feehi/feehicms |
FeehiCMS vulnerable to Cross Site Scripting CVE-2020-20589, GHSA-pwh3-3pcm-6vjh | Medium | 0.6% | 15 Dec, 2022 | Packagist feehi/feehicms |
TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz) CVE-2022-47407, GHSA-7gpw-frph-fwrg | Medium | 0.4% | 14 Dec, 2022 | Packagist fixpunkt/fp-masterquiz |
TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration BIT-typo3-2022-23504, CVE-2022-23504, GHSA-8w3p-qh3x-6gjr | Medium | 0.5% | 13 Dec, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset BIT-typo3-2022-23502, CVE-2022-23502, GHSA-mgj2-q8wp-29rr | Medium | 0.4% | 13 Dec, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login BIT-typo3-2022-23501, CVE-2022-23501, GHSA-jfp7-79g7-89rf | Medium | 0.5% | 13 Dec, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting CVE-2022-23499, GHSA-hvwx-qh2h-xcfj | Medium | 0.5% | 13 Dec, 2022 | Packagist typo3/cms Packagist typo3/html-sanitizer |
yikes-inc-easy-mailchimp-extender Cross-site Scripting vulnerability CVE-2021-4244, GHSA-837v-6vgx-jqcc | Medium | 0.6% | 12 Dec, 2022 | Packagist yikesinc/yikes-inc-easy-mailchimp-extender |
phpMyFAQ vulnerable to Cross-site Scripting CVE-2022-4408, GHSA-rjf6-wj7r-5fj2 | Medium | 0.5% | 11 Dec, 2022 | Packagist thorsten/phpmyfaq |
phpMyFAQ vulnerable to Cross-site Scripting CVE-2022-4407, GHSA-cp9c-phxx-55xm | Medium | 4.9% | 11 Dec, 2022 | Packagist thorsten/phpmyfaq |
Yii2 Gii Cross-site Scripting vulnerability CVE-2022-34297, GHSA-x87m-36g7-6mpw | Medium | 0.6% | 09 Dec, 2022 | Packagist yiisoft/yii2-gii |
Cross-site scripting vulnerability in TinyMCE alerts CVE-2022-23494, GHSA-gg8r-xjwq-4w92 | Medium | 1.0% | 08 Dec, 2022 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
PrestaShop has potential Information exposure in the upload directory CVE-2022-46158, GHSA-9qgp-9wwc-v29r | Medium | 0.5% | 08 Dec, 2022 | Packagist prestashop/prestashop |
baserCMS vulnerable to stored Cross-site Scripting CVE-2022-42486, GHSA-7w2v-35j3-xrm9 | Medium | 0.6% | 07 Dec, 2022 | Packagist baserproject/basercms |
baserCMS vulnerable to stored Cross-site Scripting CVE-2022-41994, GHSA-vxwf-79ch-f7f7 | Medium | 0.6% | 07 Dec, 2022 | Packagist baserproject/basercms |
Concrete CMS vulnerable to cross-site scripting in the text input field CVE-2022-43556, GHSA-xj33-8r43-r227 | Medium | 0.7% | 05 Dec, 2022 | Packagist concrete5/concrete5 |