Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
himiklab yii2-jqgrid-widget vulnerable to SQL Injection CVE-2014-125051, GHSA-7mg5-rw39-q67f | Critical | 0.7% | 06 Jan, 2023 | Packagist himiklab/yii2-jqgrid-widget |
DBRisinajumi d2files SQL Injection vulnerability CVE-2015-10018, GHSA-68hv-8926-j34c | Critical | 0.7% | 06 Jan, 2023 | Packagist dbrisinajumi/d2files |
nterchange Code Injection vulnerability CVE-2015-10009, GHSA-cp2p-6xh4-jmcp | Critical | 0.9% | 02 Jan, 2023 | Packagist nonfiction/nterchange |
Ariadne Component Library vulnerable to Server-Side Request Forgery CVE-2017-20157, GHSA-qr97-v87p-x965 | Critical | 0.7% | 31 Dec, 2022 | Packagist arc/web |
ThinkPHP Framework vulnerable to remote code execution CVE-2022-47945, GHSA-p4qr-vq2g-22wp | Critical | 30.2% | 23 Dec, 2022 | Packagist topthink/framework |
CodeIgniter4 Potential Session Handlers Vulnerability BIT-codeigniter-2022-46170, CVE-2022-46170, GHSA-6cq5-8cj7-g558 | Critical | 0.9% | 22 Dec, 2022 | Packagist codeigniter4/framework |
laravel-jqgrid vulnerable to SQL Injection CVE-2021-4262, GHSA-3fhj-wpvj-x5w8 | Critical | 0.7% | 19 Dec, 2022 | Packagist mgallegos/laravel-jqgrid |
Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter) CVE-2022-47408, GHSA-f683-35w9-28g5 | Critical | 0.7% | 14 Dec, 2022 | Packagist fixpunkt/fp-newsletter |
TYPO3 vulnerable to Insufficient Session Expiration CVE-2022-47406, GHSA-53mm-hx32-6475 | Critical | 0.5% | 14 Dec, 2022 | Packagist derhansen/fe_change_pwd Packagist typo3/cms |
Zenario CMS is vulnerable to Remote Code Execution (RCE). CVE-2022-44136, GHSA-4p38-rc98-cr39 | Critical | 1.2% | 30 Nov, 2022 | Packagist tribalsystems/zenario |
Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library BIT-moodle-2022-45152, CVE-2022-45152, GHSA-xqcf-vgqc-pcmg | Critical | 1.4% | 25 Nov, 2022 | Packagist moodle/moodle |
Badaso vulnerable to Remote Code Execution (RCE) CVE-2022-41705, GHSA-g389-rf5p-fg56 | Critical | 2.0% | 25 Nov, 2022 | Packagist badaso/core |
PyroCMS vulnerable to stored Cross Site Scripting CVE-2022-37721, GHSA-cm7f-hf2g-ghrp | Critical | 0.8% | 25 Nov, 2022 | Packagist pyrocms/pyrocms |
Prevent RCE when deserializing untrusted user input CVE-2022-41922, GHSA-442f-wcwq-fpcf | Critical | 1.2% | 21 Nov, 2022 | Packagist yiisoft/yii |
SQL injection in Dolibarr BIT-dolibarr-2022-4093, CVE-2022-4093, GHSA-gjg7-qfvp-9hm4 | Critical | 4.3% | 21 Nov, 2022 | Packagist dolibarr/dolibarr |
Insufficient Session Expiration in librenms/librenms CVE-2022-4070, GHSA-x93j-3hh3-6x23 | Critical | 0.7% | 20 Nov, 2022 | Packagist librenms/librenms |
Cross site scripting vulnerability with discussion titles CVE-2022-41938, GHSA-7x4w-j98p-854x | Critical | 0.8% | 19 Nov, 2022 | Packagist flarum/core |
Dolibarr vulnerable to privilege escalation BIT-dolibarr-2022-43138, CVE-2022-43138, GHSA-gh7m-j673-wm97 | Critical | 1.3% | 17 Nov, 2022 | Packagist dolibarr/dolibarr |
eZ Platform users with the Company admin role can assign any role to any user GHSA-99r3-xmmq-7q7g | Critical | Not scored | 10 Nov, 2022 | Packagist ezsystems/ezpublish-kernel |
eZ Platform users with the Company admin role can assign any role to any user GHSA-8h83-chh2-fchp | Critical | Not scored | 10 Nov, 2022 | Packagist ezsystems/ezplatform-kernel |
eZ Platform users with the Company admin role can assign any role to any user GHSA-446q-xxg5-3vhh | Critical | Not scored | 10 Nov, 2022 | Packagist ezsystems/repository-forms |
eZ Platform users with the Company admin role can assign any role to any user GHSA-pcpm-vc4v-cmvx | Critical | Not scored | 10 Nov, 2022 | Packagist ezsystems/ezplatform-admin-ui |
Ibexa DXP users with the Company admin role can assign any role to any user GHSA-g6jc-xrc3-4wwq | Critical | Not scored | 10 Nov, 2022 | Packagist ibexa/admin-ui |
Ibexa DXP users with the Company admin role can assign any role to any user GHSA-394j-x37r-2q27 | Critical | Not scored | 10 Nov, 2022 | Packagist ibexa/core |
ibexa/admin-ui vulnerable to Cross-site Scripting in content type name/shortname GHSA-7644-cxp8-h23r | Critical | Not scored | 10 Nov, 2022 | Packagist ibexa/admin-ui |
ezplatform-admin-ui vulnerable to Cross-Site Scripting (XSS) GHSA-58h5-h554-429q | Critical | Not scored | 10 Nov, 2022 | Packagist ezsystems/ezplatform-admin-ui |
GraphQL queries can expose password hashes GHSA-3p7g-wrgg-wq45 | Critical | Not scored | 10 Nov, 2022 | Packagist ibexa/graphql |
Centreon vulnerable to SQL Injection CVE-2022-3827, GHSA-j5wx-jvw3-j363 | Critical | 0.8% | 02 Nov, 2022 | Packagist centreon/centreon |
easyii CMS's File Upload Management vulnerable to unrestricted upload CVE-2022-3771, GHSA-vqvm-qrwh-69h7 | Critical | 0.6% | 31 Oct, 2022 | Packagist noumo/easyii |
phpMyFAQ contains Weak Password Requirements CVE-2022-3754, GHSA-2rr3-rv49-p42f | Critical | 1.6% | 29 Oct, 2022 | Packagist thorsten/phpmyfaq |
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout CVE-2022-39365, GHSA-5qxq-vgmm-q39m | Critical | 2.3% | 27 Oct, 2022 | Packagist pimcore/pimcore |
Prototype pollution in Snowboard framework CVE-2022-39357, GHSA-3fh5-q6fg-w28q | Critical | 1.4% | 26 Oct, 2022 | Packagist wintercms/winter |
Badaso vulnerable to Remote Code Execution via malicious file upload CVE-2022-41711, GHSA-fwvc-9xhj-26v5 | Critical | 2.1% | 25 Oct, 2022 | Packagist badaso/core |
Dolibarr vulnerable to Eval Injection BIT-dolibarr-2022-40871, CVE-2022-40871, GHSA-7cm4-vmf2-8wf2 | Critical | 34.6% | 12 Oct, 2022 | Packagist dolibarr/dolibarr |
melisplatform/melis-cms vulnerable to deserialization of untrusted data CVE-2022-39297, GHSA-m3m3-6gww-7gj9 | Critical | 1.3% | 11 Oct, 2022 | Packagist melisplatform/melis-cms |
melisplatform/melis-front vulnerable to deserialization of untrusted data CVE-2022-39298, GHSA-h479-2mv4-5c26 | Critical | 1.3% | 11 Oct, 2022 | Packagist melisplatform/melis-front |
Moodle Minor SQL injection risk in admin user browsing BIT-moodle-2022-40315, CVE-2022-40315, GHSA-mqw9-3cjm-xwp3 | Critical | 1.1% | 30 Sep, 2022 | Packagist moodle/moodle |
Moodle remote code execution BIT-moodle-2022-40314, CVE-2022-40314, GHSA-2hmm-q272-xmhf | Critical | 2.1% | 30 Sep, 2022 | Packagist moodle/moodle |
Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2022-38916, GHSA-4v5m-vwvp-p7w8 | Critical | 18.3% | 20 Sep, 2022 | Packagist pagekit/pagekit |
ThinkPHP deserialization vulnerability CVE-2022-38352, GHSA-qjjj-7g7h-54v3 | Critical | 21.0% | 15 Sep, 2022 | Packagist topthink/framework |
Rank Math SEO plugin vulnerable to Server-Side Request Forgery CVE-2022-36376, GHSA-j95r-86hx-xwxg | Critical | 1.0% | 09 Sep, 2022 | Packagist rankmath/seo-by-rank-math |
FeehiCMS has an arbitrary file upload vulnerability CVE-2020-21516, GHSA-jj62-mc3m-j769 | Critical | 1.2% | 06 Sep, 2022 | Packagist feehi/cms |
RosarioSIS before 10.1 vulnerable to Improper Handling of Length Parameter Inconsistency CVE-2022-2714, GHSA-vh4m-mw8w-g4w8 | Critical | 0.9% | 06 Sep, 2022 | Packagist francoisjacquet/rosariosis |
Missing password strength check in notrinos/notrinos-erp CVE-2022-2927, GHSA-qhm8-69qh-g76j | Critical | 0.9% | 22 Aug, 2022 | Packagist notrinos/notrinos-erp |
Magento Improper Authorization vulnerability BIT-magento-2022-34256, CVE-2022-34256, GHSA-r7mm-grf3-5fjv | Critical | 2.1% | 16 Aug, 2022 | Packagist magento/community-edition |
Magento XML Injection vulnerability in the Widgets Module BIT-magento-2022-34253, CVE-2022-34253, GHSA-cj7w-pm77-hvg6 | Critical | 5.0% | 16 Aug, 2022 | Packagist magento/community-edition |
Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration CVE-2022-2713, GHSA-vm6p-35rw-3fxc | Critical | 1.3% | 08 Aug, 2022 | Packagist aheinze/cockpit |
PrestaShop eval injection possible if shop vulnerable to SQL injection CVE-2022-31181, GHSA-hrgx-p36p-89q4 | Critical | 6.7% | 29 Jul, 2022 | Packagist prestashop/prestashop |
Moodle PostScript Code Injection BIT-moodle-2022-35649, CVE-2022-35649, GHSA-xp2f-9mx3-3c6p | Critical | 8.6% | 25 Jul, 2022 | Packagist moodle/moodle |
Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository GHSA-m58q-qq5h-mgqq | Critical | Not scored | 21 Jul, 2022 | Packagist islandora/islandora |