Advisory Catalog

YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters

YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read

YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

laravel-backup-restore has an OS Command Injection during database restore

Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Composer: Arbitrary file write outside vendor via malicious transitive package name

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose

EGroupware has Authenticated RCE via Malicious eTemplate Upload

EGroupware has a Remote Code Execution Vulnerability

Formie Hidden field defaults vulnerable to Server-Side Template Injection

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation

SimpleSAMLphp has Possible DoS via XPath Transform

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API

Froxlor: Authenticated customers can read other customers' allowed sender aliases

mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Craft CMS: Stored XSS via Structure entry title in table view

Silverstripe Framework: Possible XSS attack through media embed

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

Kimai Password Reset Link Remains Valid After Password Change

Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

Schema.org has cross-site scripting (XSS) via script break-out in toScript() output

EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components

phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

Paymenter has race condition in payWithCredit() that enables credit double-spend

Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters