GHSA-9X44-4GXF-8C25 Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

Overview A DataObject class-definition field name is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class protected $;. A user holding only the ordinary objects DataObjects permission can import a class definition whose field...

CVE-2020-7614

npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly...