104 matches found
CVE-2026-81892 EasyAdmin custom-action dispatcher bypasses access_control on other routes
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...
CVE-2026-81892
EasyAdmin for Symfony (versions 4.0.0 through 4.29.16 and 5.5.1) contains a security bypass in its custom-action dispatcher. When Action::linkToRoute() or MenuItem::linkToRoute() is used, the executed controller is swapped via the routeName query parameter on the kernel.controller event — after S...
PT-2026-84023
Name of the Vulnerable Software and Affected Versions EasyAdmin versions 4.0.0 through 4.29.15 EasyAdmin versions 5.x through 5.5.0 Description EasyAdmin serves backend requests through a single dashboard route. For custom actions using Action::linkToRoute and MenuItem::linkToRoute, the software...
CVE-2026-81892: Authorization Bypass Through User-Controlled Key
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...
GHSA-8559-GWJ3-Q37R EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
EasyAdmin's FileField and ImageField accept browser-executable file types by default FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG. When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin...
PT-2026-60099
Name of the Vulnerable Software and Affected Versions EasyAdmin affected versions not specified Description Stored Cross-Site Scripting XSS occurs because FileField and ImageField accept browser-executable file types by default. FileField applies no MIME or extension restrictions, while ImageFiel...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to fields 'FileField' and 'ImageField' accepting browser-executable file types by default. When the upload directory is configured inside the public web root EasyAdmin links to the stored file inline. Detail...
Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
EasyAdmin's FileField and ImageField accept browser-executable file types by default FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG. When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin...
CVE-2024-2825
A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the argument file leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The...
CVE-2024-2826
A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been...
CVE-2024-2828
A vulnerability, which was classified as critical, was found in lakernote EasyAdmin up to 20240315. Affected is the function thumbnail of the file src/main/java/com/laker/admin/module/sys/controller/IndexController.java. The manipulation of the argument url leads to server-side request forgery. I...
EUVD-2024-27771
Malicious code in bioql PyPI...
EUVD-2024-27772
Malicious code in bioql PyPI...
EUVD-2024-31687
Malicious code in bioql PyPI...
EUVD-2024-46608
Malicious code in bioql PyPI...
EUVD-2024-27769
Malicious code in bioql PyPI...
EUVD-2024-27770
Malicious code in bioql PyPI...
CVE-2024-2827
A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315. This issue affects some unknown processing of the file /ureport/designer/saveReportFile. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploi...
CVE-2024-3081
A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. T...
CVE-2024-5383
A vulnerability classified as problematic has been found in lakernote EasyAdmin up to 20240324. This affects an unknown part of the file /sys/file/upload. The manipulation of the argument file leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...