Advisory Catalog

OpenMage LTS: Phar Deserialization leads to Remote Code Execution

YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()

PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes

elFinder: Command injection in resize background color parameter when using ImageMagick CLI

Craftql vulnerable to Server-Side Request Forgery

Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar

Statamic: Unsafe method invocation via query value resolution allows data destruction

WWBN AVideo: RCE cause by clonesite plugin

Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron

WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal

WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses

WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover

WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)

WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header

Composer has a command injection via malicious perforce repository

Composer has a command injection via malicious perforce reference

Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php

Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php

Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php

Webkul Krayin CRM has Server-Side Request Forgery (SSRF)

Craft Commerce hasVariant/hasProduct Blind SQL Injection

Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget

Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php

Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens

CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass

CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling

PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket

OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals

Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message

Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler

Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption

Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption

Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption

OpenSTAManager: SQL Injection via Aggiornamenti Module

phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2

OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter

YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter"

AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints

AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php