Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenCart SQL injection vulnerability CVE-2021-37823, GHSA-236j-rfx5-wq38 | Medium | 0.9% | 03 Nov, 2022 | Packagist opencart/opencart |
Tribal Systems Zenario CMS vulnerable to Cross-site Scripting CVE-2020-36608, GHSA-f92p-f8r2-c87q | Medium | 0.5% | 02 Nov, 2022 | Packagist tribalsystems/zenario |
TablePress Plugin vulnerable to Cross-site Scripting CVE-2022-3788, GHSA-9mf2-hpj4-rw3r | Medium | Not scored | 01 Nov, 2022 | Packagist tobiasbg/tablepress |
ProcessWire vulnerable to Cross-Site Request Forgery CVE-2022-40488, GHSA-vpwh-qmwc-2phg | Medium | 0.3% | 31 Oct, 2022 | Packagist processwire/processwire |
ProcessWire vulnerable to Cross-site Scripting CVE-2022-40487, GHSA-8g35-prrr-gxxf | Medium | 0.5% | 31 Oct, 2022 | Packagist processwire/processwire |
phpMyFAQ vulnerable to reflected Cross-site Scripting CVE-2022-3766, GHSA-mg5h-rhjq-6v84 | Medium | 8.3% | 31 Oct, 2022 | Packagist thorsten/phpmyfaq |
phpMyFAQ vulnerable to stored Cross-site Scripting CVE-2022-3765, GHSA-wr74-2v66-57pp | Medium | 0.7% | 31 Oct, 2022 | Packagist thorsten/phpmyfaq |
HyperDown vulnerable to Cross-site Scripting CVE-2022-25849, GHSA-4r9g-w48q-8jwm | Medium | 0.6% | 26 Oct, 2022 | Packagist joyqi/hyper-down |
Kirby CMS vulnerable to user enumeration in the brute force protection CVE-2022-39315, GHSA-c27j-76xg-6x4f | Medium | 0.8% | 18 Oct, 2022 | Packagist getkirby/cms |
Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms CVE-2022-39314, GHSA-43qq-qw4x-28f8 | Medium | 0.4% | 18 Oct, 2022 | Packagist getkirby/cms |
OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration CVE-2022-31037, GHSA-4vf4-955g-vxp2 | Medium | 0.5% | 18 Oct, 2022 | Packagist oro/commerce |
Magento Open Source allows Improper Access Control CVE-2022-35689, GHSA-5fxx-jwjm-x9hj | Medium | 1.4% | 14 Oct, 2022 | Packagist magento/community-edition Packagist magento/project-community-edition |
Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued BIT-codeigniter-2022-39284, CVE-2022-39284, GHSA-745p-r637-7vvp | Medium | 1.1% | 06 Oct, 2022 | Packagist codeigniter4/framework |
YetiForce CRM vulnerable to stored Cross-site Scripting CVE-2022-3002, GHSA-v9fj-h8g6-4w9q | Medium | 0.7% | 06 Oct, 2022 | Packagist yetiforce/yetiforce-crm |
Moodle No groups filtering in H5P activity attempts report BIT-moodle-2022-40316, CVE-2022-40316, GHSA-385f-vgq7-8hhx | Medium | 0.7% | 30 Sep, 2022 | Packagist moodle/moodle |
FeehiCMS vulnerable to Cross-Site scripting via crafted payload CVE-2022-40408, GHSA-5mqq-7g25-r4wx | Medium | 0.5% | 29 Sep, 2022 | Packagist feehi/feehicms |
Moodle Exposure of Sensitive Information to an Unauthorized Actor BIT-moodle-2021-40695, CVE-2021-40695, GHSA-gp4w-f57r-9rx3 | Medium | 0.9% | 29 Sep, 2022 | Packagist moodle/moodle |
Moodle Improper Encoding or Escaping of Output BIT-moodle-2021-40694, CVE-2021-40694, GHSA-m37g-mwcg-7j7v | Medium | 0.9% | 29 Sep, 2022 | Packagist moodle/moodle |
Moodle type juggling vulnerability BIT-moodle-2021-40693, CVE-2021-40693, GHSA-2jxg-mv2m-j4r7 | Medium | 0.8% | 29 Sep, 2022 | Packagist moodle/moodle |
Moodle Incorrect Authorization BIT-moodle-2021-40692, CVE-2021-40692, GHSA-wr6q-xv23-rfq9 | Medium | 0.6% | 29 Sep, 2022 | Packagist moodle/moodle |
Moodle Improper Authentication BIT-moodle-2021-40691, CVE-2021-40691, GHSA-92vh-mr2w-j2cr | Medium | 0.7% | 29 Sep, 2022 | Packagist moodle/moodle |
EC-CUBE DOM-based cross-site scripting vulnerability CVE-2022-38975, GHSA-pggw-rqfm-72rh | Medium | 0.7% | 27 Sep, 2022 | Packagist ec-cube/ec-cube |
Centreon contains cross-site scripting vulnerability via esc_name parameter CVE-2022-40044, GHSA-rv5q-72p2-2q24 | Medium | 0.8% | 26 Sep, 2022 | Packagist centreon/centreon |
Awesome Support vulnerable to persistent cross-site scripting CVE-2022-38073, GHSA-qrqm-574x-q7f2 | Medium | 0.6% | 21 Sep, 2022 | Packagist awesome-support/awesome-support |
Craft CMS Cross-site Scripting vulnerability CVE-2022-37246, GHSA-f546-v666-559x | Medium | 0.5% | 21 Sep, 2022 | Packagist craftcms/cms |
Pimcore vulnerable to cross site scripting CVE-2022-3255, GHSA-wqr6-57qm-hhr5 | Medium | 0.8% | 21 Sep, 2022 | Packagist pimcore/pimcore |
Microweber vulnerable to HTML Injection in create tag functionality CVE-2022-3245, GHSA-gm8c-w9cm-c445 | Medium | 0.7% | 20 Sep, 2022 | Packagist microweber/microweber |
Microweber Cross-site Scripting can result in redirection to a malicious site CVE-2022-3242, GHSA-232p-59mg-f98p | Medium | 1.9% | 20 Sep, 2022 | Packagist microweber/microweber |
YetiForce CRM vulnerable to stored Cross-site Scripting via SlaPolicy module CVE-2022-3005, GHSA-vx3x-hwph-grvw | Medium | 0.7% | 20 Sep, 2022 | Packagist yetiforce/yetiforce-crm |
YetiForce CRM vulnerable to stored Cross-site Scripting via WorkFlow module CVE-2022-3004, GHSA-qwc8-vjh3-gm2j | Medium | 0.7% | 20 Sep, 2022 | Packagist yetiforce/yetiforce-crm |
YetiForce CRM vulnerable to stored Cross-site Scripting via LayoutEditor module CVE-2022-3000, GHSA-mqh9-5jp9-6799 | Medium | 0.7% | 20 Sep, 2022 | Packagist yetiforce/yetiforce-crm |
YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module CVE-2022-2924, GHSA-2qf8-h7pr-x2r8 | Medium | 0.8% | 20 Sep, 2022 | Packagist yetiforce/yetiforce-crm |
LibreNMS stored Cross-site Scripting via Schedule Maintenance `Title` parameter CVE-2022-3231, GHSA-3jh2-wmv7-m932 | Medium | 0.7% | 17 Sep, 2022 | Packagist librenms/librenms |
Snipe-IT vulnerable to Improper Authentication CVE-2022-3173, GHSA-fhvv-p968-6vvj | Medium | 0.9% | 17 Sep, 2022 | Packagist snipe/snipe-it |
Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts CVE-2022-37251, GHSA-mw37-wx8p-gp45 | Medium | 0.5% | 16 Sep, 2022 | Packagist craftcms/cms |
Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page CVE-2022-37247, GHSA-3cvm-7wrh-qrf9 | Medium | 0.6% | 16 Sep, 2022 | Packagist craftcms/cms |
Craft CMS Cross site Scripting vulnerability CVE-2022-37248, GHSA-wxvf-839f-jqmh | Medium | 0.7% | 16 Sep, 2022 | Packagist craftcms/cms |
Craft CMS Stored Cross-site Scripting in User Addresses Title CVE-2022-37250, GHSA-8r89-x93x-mjq2 | Medium | 0.7% | 16 Sep, 2022 | Packagist craftcms/cms |
Pimcore vulnerable to stored stored Cross-site Scripting via`properties` when creating new users CVE-2022-3211, GHSA-4849-x3jx-45qr | Medium | 0.5% | 15 Sep, 2022 | Packagist pimcore/pimcore |
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection GHSA-gqqf-g5r7-84vf | Medium | Not scored | 15 Sep, 2022 | Packagist typo3/cms-core |
Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto CVE-2018-25047, GHSA-hwq7-5vv9-c6cf | Medium | 1.1% | 15 Sep, 2022 | Packagist smarty/smarty |
UniSharp Laravel Filemanager directory traversal vulnerability CVE-2022-40734, GHSA-5m2h-7rf2-rpx6 | Medium | 5.2% | 14 Sep, 2022 | Packagist unisharp/laravel-filemanager |
Feehi CMS host header injection vulnerability CVE-2022-38796, GHSA-4r4f-jrvw-h727 | Medium | 0.6% | 14 Sep, 2022 | Packagist feehi/cms |
Moodle Cross-site Scripting vulnerability BIT-moodle-2021-36568, CVE-2021-36568, GHSA-fm6m-fg23-67jq | Medium | 1.0% | 13 Sep, 2022 | Packagist moodle/moodle |
TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper BIT-typo3-2022-36108, CVE-2022-36108, GHSA-fv2m-9249-qx85 | Medium | 0.9% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController BIT-typo3-2022-36107, CVE-2022-36107, GHSA-9c6w-55cp-5w25 | Medium | 0.9% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS missing check for expiration time of password reset token for backend users BIT-typo3-2022-36106, CVE-2022-36106, GHSA-5959-4x58-r8c2 | Medium | 0.9% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS vulnerable to User Enumeration via Response Timing BIT-typo3-2022-36105, CVE-2022-36105, GHSA-m392-235j-9r7r | Medium | 1.3% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection CVE-2022-36020, GHSA-47m6-46mj-p235 | Medium | 0.8% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3/html-sanitizer |
Shopware contains sensitive data in backend customer module CVE-2022-36101, GHSA-6vfq-jmxg-g58r | Medium | 0.7% | 12 Sep, 2022 | Packagist shopware/shopware |