Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section CVE-2023-28473, GHSA-pj76-75cm-3552 | Critical | 0.8% | 28 Apr, 2023 | Packagist concrete5/concrete5 |
Remote code execution in Voyager CVE-2020-36070, GHSA-2x3r-7jgm-gh8x | Critical | 1.1% | 26 Apr, 2023 | Packagist tcg/voyager |
SQL filter bypass leading to arbitrary write requests using "SQL Manager" CVE-2023-30839, GHSA-p379-cxqh-q822 | Critical | 1.7% | 25 Apr, 2023 | Packagist prestashop/prestashop |
Possible XSS injection through Validate::isCleanHTML method CVE-2023-30838, GHSA-fh7r-996q-gvcp | Critical | 1.0% | 25 Apr, 2023 | Packagist prestashop/prestashop |
Access bypass in Drupal core BIT-drupal-2023-31250, CVE-2023-31250, DRUPAL-CORE-2023-005, GHSA-8849-cv9f-vccm | Critical | 0.5% | 19 Apr, 2023 | Packagist drupal/core |
froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type CVE-2023-2034, GHSA-qwvp-g9j7-28f6 | Critical | 71.4% | 14 Apr, 2023 | Packagist froxlor/froxlor |
thorsten/phpmyfaq vulnerable to authentication bypass CVE-2023-1886, GHSA-4cr4-x82x-hwm9 | Critical | 0.9% | 05 Apr, 2023 | Packagist thorsten/phpmyfaq |
Microweber vulnerable to command injection CVE-2023-1877, GHSA-582p-2fpg-x226 | Critical | 1.8% | 05 Apr, 2023 | Packagist microweber/microweber |
Firefly III insufficiently expires sessions CVE-2023-1788, GHSA-h7vv-46p5-prmh | Critical | 0.4% | 05 Apr, 2023 | Packagist grumpydictator/firefly-iii |
Withdrawn: SQL injection in Yii 2 CVE-2023-26750, GHSA-gq63-p39p-jrjf | Critical | 1.8% | 04 Apr, 2023 | Packagist yiisoft/yii2 |
Firefly III vulnerable to improper input validation CVE-2023-1789, GHSA-mwxw-hxvp-4r2r | Critical | 0.3% | 01 Apr, 2023 | Packagist grumpydictator/firefly-iii |
X-Forwarded-For header allows brute-forcing autoblocked IP addresses BIT-mediawiki-2023-29141, CVE-2023-29141, GHSA-5vj8-g3qg-4qh6 | Critical | 1.2% | 31 Mar, 2023 | Packagist mediawiki/core |
phpMyFAQ has weak password requirements CVE-2023-1753, GHSA-4p4m-5qp7-479x | Critical | 0.7% | 31 Mar, 2023 | Packagist thorsten/phpmyfaq |
Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input BIT-moodle-2023-28333, CVE-2023-28333, GHSA-q2x3-2f9g-h559 | Critical | 1.2% | 23 Mar, 2023 | Packagist moodle/moodle |
baserCMS allows any file to be uploaded CVE-2023-25655, GHSA-mfvg-qwcw-qvc8 | Critical | 1.1% | 23 Mar, 2023 | Packagist baserproject/basercms |
baserCMS File Uploader Remote Code Execution (RCE) vulnerability CVE-2023-25654, GHSA-h4cc-fxpp-pgw9 | Critical | 1.5% | 23 Mar, 2023 | Packagist baserproject/basercms |
PHAR deserialization allowing remote code execution CVE-2023-28115, GHSA-gq6w-q6wh-jggc | Critical | 2.8% | 17 Mar, 2023 | Packagist knplabs/knp-snappy |
Funadmin vulnerable to SQL injection CVE-2023-24774, GHSA-jx2x-fg9p-7gc7 | Critical | 0.9% | 10 Mar, 2023 | Packagist funadmin/funadmin |
Froxlor is vulnerable to authentication bypass CVE-2023-1307, GHSA-j83x-r9qq-9g4v | Critical | 1.1% | 10 Mar, 2023 | Packagist froxlor/froxlor |
SQL Injection in Funadmin CVE-2023-24777, GHSA-pvp6-53r9-8vxh | Critical | 0.7% | 08 Mar, 2023 | Packagist funadmin/funadmin |
SQL Injection in Funadmin CVE-2023-24782, GHSA-qhq8-2f3m-gxvp | Critical | 0.7% | 08 Mar, 2023 | Packagist funadmin/funadmin |
SQL Injection in Funadmin CVE-2023-24773, GHSA-m8wf-wmwh-jw2m | Critical | 0.7% | 08 Mar, 2023 | Packagist funadmin/funadmin |
Easy!Appointments uses hard-coded credentials CVE-2023-1269, GHSA-347f-rxg8-qgrv | Critical | 0.7% | 08 Mar, 2023 | Packagist alextselegidis/easyappointments |
SQL Injection in Funadmin CVE-2023-24780, GHSA-7pmh-8qjj-4q36 | Critical | 0.8% | 08 Mar, 2023 | Packagist funadmin/funadmin |
SQL Injection in Funadmin CVE-2023-24775, GHSA-v43v-pv95-jc55 | Critical | 19.8% | 07 Mar, 2023 | Packagist funadmin/funadmin |
SQL Injection in Funadmin CVE-2023-24781, GHSA-vhrv-9f9g-rfrx | Critical | 0.7% | 07 Mar, 2023 | Packagist funadmin/funadmin |
Moodle Session Fixation vulnerability BIT-moodle-2021-36394, CVE-2021-36394, GHSA-2563-fp9c-mgm8 | Critical | 7.0% | 06 Mar, 2023 | Packagist moodle/moodle |
Moodle SQL Injection vulnerability BIT-moodle-2021-36393, CVE-2021-36393, GHSA-f46j-r7q3-6cm2 | Critical | 52.3% | 06 Mar, 2023 | Packagist moodle/moodle |
Moodle SQL Injection vulnerability BIT-moodle-2021-36392, CVE-2021-36392, GHSA-qc86-vgf2-6fq6 | Critical | 0.8% | 06 Mar, 2023 | Packagist moodle/moodle |
Remote code execution in Funadmin CVE-2023-24776, GHSA-7g53-jj25-jhgr | Critical | 1.4% | 06 Mar, 2023 | Packagist funadmin/funadmin |
Cross-site Scripting in kimai/kimai CVE-2020-19825, GHSA-r58m-v5pr-jhhq | Critical | 0.7% | 15 Feb, 2023 | Packagist kimai/kimai |
Command Injection in thorsten/phpmyfaq CVE-2023-0789, GHSA-6vp5-vv9p-7q62 | Critical | 1.7% | 12 Feb, 2023 | Packagist thorsten/phpmyfaq |
Code Injection in thorsten/phpmyfaq CVE-2023-0788, GHSA-r6cw-356h-mvwg | Critical | 0.9% | 12 Feb, 2023 | Packagist thorsten/phpmyfaq |
SQL injection in webbuilders-group silverstripe-kapost-bridge CVE-2015-10077, GHSA-32gr-x76g-267w | Critical | 0.7% | 10 Feb, 2023 | Packagist webbuilders-group/silverstripe-kapost-bridge |
Deserialization of Untrusted Data in thinkphp CVE-2022-45982, GHSA-j2h2-g882-x9j2 | Critical | 1.2% | 08 Feb, 2023 | Packagist topthink/think |
URI validation failure on SVG parsing. Bypass of CVE-2023-23924 CVE-2023-24813, GHSA-56gj-mvh6-rp75 | Critical | 2.5% | 07 Feb, 2023 | Packagist dompdf/dompdf |
tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML function CVE-2015-10073, GHSA-84mm-prjg-49xm | Critical | 0.9% | 06 Feb, 2023 | Packagist tinymighty/wiki-seo |
AVideo contains Command injection when embedding a video link CVE-2023-25313, GHSA-pgvh-p3g4-86jw | Critical | 1.3% | 02 Feb, 2023 | Packagist wwbn/avideo |
Dompdf vulnerable to URI validation failure on SVG parsing CVE-2023-23924, GHSA-3cw5-7cxw-v5qg | Critical | 3.6% | 01 Feb, 2023 | Packagist dompdf/dompdf |
phpmyadmin contains SQL Injection vulnerability BIT-phpmyadmin-2020-22452, CVE-2020-22452, GHSA-prcg-mc23-hgjh | Critical | 1.7% | 26 Jan, 2023 | Packagist phpmyadmin/phpmyadmin |
XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2021-26642, GHSA-8r5j-22j5-w4cm | Critical | 1.2% | 20 Jan, 2023 | Packagist xpressengine/xpressengine |
Shopware has Insufficient Session Expiration in Administration CVE-2023-22732, GHSA-59qg-93jg-236f | Critical | 0.8% | 17 Jan, 2023 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views CVE-2023-22731, GHSA-93cw-f5jj-x85w | Critical | 1.4% | 17 Jan, 2023 | Packagist shopware/core Packagist shopware/platform |
CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection CVE-2023-22727, GHSA-6g8q-qfpv-57wp | Critical | 0.9% | 17 Jan, 2023 | Packagist cakephp/cakephp Packagist cakephp/database |
SQL Injection in liftkit/database CVE-2016-15020, GHSA-8hcf-2m4v-f2rq | Critical | 0.7% | 16 Jan, 2023 | Packagist liftkit/database |
phpMyFAQ Improper Authentication vulnerability CVE-2023-0311, GHSA-g92r-9rxw-cmgx | Critical | 1.0% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
phpMyFAQ has Weak Password Requirements CVE-2023-0307, GHSA-4p88-cfhq-f3vg | Critical | 0.7% | 15 Jan, 2023 | Packagist thorsten/phpmyfaq |
WebPA SQL Injection vulnerability CVE-2021-4308, GHSA-mjgw-f2c4-f8qj | Critical | 0.7% | 08 Jan, 2023 | Packagist webpa/webpa |
PaginationServiceProvider SQL Injection vulnerability CVE-2014-125029, GHSA-ww43-mcvh-35p4 | Critical | 0.9% | 07 Jan, 2023 | Packagist ttskch/pagination-service-provider |
kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference CVE-2015-10029, GHSA-rh3m-pr36-xh2f | Critical | 0.8% | 07 Jan, 2023 | Packagist kelvinmo/simplexrd |