CVE-2025-3510 tagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2024-13645 TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which mean...

CVE-2025-1705 tagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation within the tdajaxgetviews AJAX action. This makes it possible for unauthenticated attackers to inject malicious web...

CVE-2025-2804 tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'accountid' and 'accountusername' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2022-24828

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call VcsDriver::getFileContent can have a code injection vulnerability if the user can control the $file or $identifier argument. This leads to a vulnerability on packagist.org for example where...

CVE-2024-24821

Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local...

Important: composer

Issue Overview: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories...

Important: composer

Issue Overview: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches fo...

The vulnerability of the composer.phar file of the PHP Composer dependency manager allows a attacker to execute arbitrary commands.

The vulnerability of the composer.phar file of the PHP Composer dependency manager is related to the registerargcargv function in php.ini. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Command Injection

composer/composer is vulnerable to Command Injection. This vulnerability is due to specially crafted branch names in git/hg repositories, when executing the composer install command, which allows an attacker to execute arbitrary commands...

Code Execution

composer/composer is vulnerable to Code Execution. The vulnerability is due to improper branch name sanitization within the status, reinstall, and remove commands when handling packages installed from source via git, which allows an attacker to execute arbitrary code...

SUSE CVE-2024-35241

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are...

composer security vulnerability

composer is a software application. It provides a statement to manage and install dependencies for PHP projects. A security vulnerability exists in composer versions prior to 2.2.24 and 2.7.7, which stems from the fact that the composer install command run from a git/hg repository with a speciall...

PT-2024-4386

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.24 and 2.7.7 Description The issue is related to the incorrect neutralization of special elements in the getUnpushedChanges function of the Composer dependency manager for PHP. This can allow a remote attacker to...

composer security vulnerability

composer is a software application. It provides a declaration to manage and install dependencies of PHP projects. A security vulnerability exists in composer versions prior to 2.2.24 and 2.7.7, which stems from the ability to execute code using the status, reinstall, and remove commands, as well ...

Important: composer

Issue Overview: Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead...

The vulnerability of the InstalledVersions.php and install.php scripts of the PHP Composer dependency manager allows a hacker to execute arbitrary code and gain elevated privileges.

The vulnerability of the InstalledVersions.php and install.php scripts of the PHP Composer dependency manager is related to the inclusion of functions from an unverified controlled area. Exploiting this vulnerability could allow a attacker to execute arbitrary code and increase their privileges...

SUSE CVE-2024-24821

Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local...

DEBIAN-CVE-2024-24821

Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local...

Composer Security Vulnerabilities

composer is a software application . Provides a declaration, management and installation of dependencies for PHP projects. A security vulnerability exists in Composer versions prior to 2.2.23 and prior to 2.7.0, which stems from the presence of an arbitrary code execution vulnerability. An attack...