Advisory Catalog

PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

Contao: Cross-site request forgery in custom backend actions

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Laravel: XSS in Debug Page Information

October CMS: PHP Object Injection via Backend Widget Session Storage

October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

Filament: Password validity disclosure for accounts denied panel access on login page

PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

OpenSTAManager has HTML Injection in modules/utenti/edit.php

Winter: Stored XSS through Backend List widget image columns

Contao: Possible path traversal in job download URIs

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao crawler leaks auth credentials to external hosts

Dompdf: File existence oracle via font-face stylesheet declaration

Dompdf: Chroot Validation Bypass

FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass

Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

Schema.org has cross-site scripting (XSS) via script break-out in toScript() output

Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors

Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted

PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles

The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via `providers.json` and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL.

Subrion CMS vulnerable to Cross-site Scripting

TYPO3 CMS has Broken Access Control in its File Abstraction Layer

TYPO3 HTML Sanitizer allows Cross-site Scripting

phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API

Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)

Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

Pterodactyl has a database resource limit bypass via race condition in Client API

Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme

Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog

Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate

Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design