Advisory Catalog

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

zbateson/mail-mime-parser has CRLF header injection via attachment filename

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Snipe-IT: 2FA bypass via the API token flow

phpMyFAQ's two-factor authentication login bypasses the password factor

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Formie: Missing authorization on sent notification resend modal exposes submission PII

Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Shopper: Missing authorization on product removal actions in CollectionProducts component

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper: privilege escalation via improper Livewire admin component authorization

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Composer arbitrary command execution via a malicious package's Perforce source URL

league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

EasyAdmin custom-action dispatcher bypasses access_control on other routes

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Kirby: File upload permissions are not checked during processing of chunk data

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

mongodb: Reject "." and NUL bytes in database and collection names

silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template

silverstripe/userforms vulnerable to remote code execution via userforms email subject

LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates