Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the authorization process for Livewire admin components. An attacker can gain elevated privileges, create new admin users, or delete roles and permissions by exploiting insufficient permission checks in the...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the admin Livewire components, where improper handling of model identifiers, hidden form fields, and barcode rendering occurs. An attacker can access sensitive information, manipulate...

GHSA-F946-9QP6-VGCH shopper/framework: Authorization bypass in multiple Livewire admin components

Impact Multiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission: - Order detail Filament actions cancel, mark paid, mark complete, capture payment, archive, start processing were callable with readorders only and di...

shopper/framework: Authorization bypass in multiple Livewire admin components

Impact Multiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission: - Order detail Filament actions cancel, mark paid, mark complete, capture payment, archive, start processing were callable with readorders only and di...

Emlog Pro security vulnerabilities

Emlog Pro is a blogging system of Emlog open source. A security vulnerability exists in Emlog Pro version 2.5.20, which stems from a lack of path validation in the admin/template.php and admin/plugin.php components, which could result in the deletion of arbitrary files...

CVE-2025-61318

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature...

EUVD-2017-15565

Malware in sbrugna...

MAL-2025-41033 Malicious code in zmarta-admin-components (npm)

The package zmarta-admin-components was found to contain malicious code...

Malicious code in zmarta-admin-components (npm)

The package zmarta-admin-components was found to contain malicious code...

CVE-2024-26070 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page...

Cross site scripting

Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php id parameter...

CVE-2017-6509: Improper Neutralization of Input During Web Page Generation

Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php id parameter...

PT-2017-17122

Name of the Vulnerable Software and Affected Versions burgundy-cms versions prior to 2017-03-06 Description The issue is related to a reflected XSS in the admin/components/menu/views/menuitems.php file, specifically affecting the id parameter. Recommendations For versions prior to 2017-03-06,...