1773 matches found
Cross-Site Scripting in Backend Modal Component
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-007...
URL Rewrite vulnerability
More info at https://framework.zend.com/security/advisory/ZF2018-01...
SS-2017-009: Users inadvertently passing sensitive data to LoginAttempt
More info at https://www.silverstripe.org/download/security-releases/ss-2017-009/...
SS-2017-002: Member disclosure in login form
More info at https://www.silverstripe.org/download/security-releases/ss-2017-002/...
SS-2017-003: XSS in RedirectorPage
More info at https://www.silverstripe.org/download/security-releases/ss-2017-003/...
SUPEE-9652 - Remote Code Execution using mail vulnerability
More info at https://magento.com/security/patches/supee-9652...
Cross-Site Scripting vulnerability in typolinks
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-018...
Missing Access Check in TYPO3 CMS
More info at https://typo3.org/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/missing-access-check-in-typo3-cms/...
Privilege Escalation in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-012/...
SS-2016-002: CSRF vulnerability in GridFieldAddExistingAutocompleter
More info at https://www.silverstripe.org/download/security-releases/ss-2016-002/...
XSS vulnerabilities in Neos
More info at https://www.neos.io/blog/neos-sa-2015-002.html...
Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word
More info at https://framework.zend.com/security/advisory/ZF2015-09...
SS-2015-026: Form field validation message XSS vulnerability
More info at https://www.silverstripe.org/download/security-releases/ss-2015-026/...
Remote File Inclusion through View template name manipulation
More info at https://bakery.cakephp.org/2015/11/05/cakephp30153142612276released.html...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
SS-2015-016: XSS in install.php
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-016/...
Brute Force Protection Bypass in backend login
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-006/...
Information Disclosure possibility exploitable by Editors
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-005/...
SS-2015-013: X-Forwarded-Host request hostname injection
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-013/...
Denial of Service attack through XML payloads
More info at https://bakery.cakephp.org/2015/05/28/cakephp266and306released.html...
Incorrect CSRF validation
More info at https://bakery.cakephp.org/2015/05/07/cakephp304released.html...
SS-2014-017: XML Quadratic Blowup Attack
More info at https://www.silverstripe.org/software/download/security-releases/ss-2014-017-xml-quadratic-blowup-attack/...
Risk of mass-assignment vulnerabilities
More info at https://laravel.com/docs/5.1/upgradeupgrade-4.1.29...
Authentication Vulnerability - possible attempt to login via zero-valued password credential
Security advisory: zero-valued authentication credentials vulnerability DoctrineModule version 0.7.2 has been just released and includes a security fix for 248 via @5f79a9f7b and @78018ef568, Affected versions All versions below 0.7.2 are affected. dev-master and 0.8.x are not affected starting...
Potential SQL injection due to execution of platform-specific SQL containing interpolations
More info at https://framework.zend.com/security/advisory/ZF2013-03...
SQL injection possibility
More info at https://www.doctrine-project.org/blog/dbal-security-2011-1.html...
Potential XSS vector in Zend_Dojo_View_Helper_Editor
More info at https://framework.zend.com/security/advisory/ZF2010-02...
Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010
More info at https://www.drupal.org/sa-core-2019-010...
CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS
More info at https://symfony.com/cve-2026-45756...
CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
More info at https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass...
Anonymous Open Redirect - Moderately Critical - Open Redirect
More info at https://www.drupal.org/sa-core-2018-006...
CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
More info at https://symfony.com/cve-2026-45068...
CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
More info at https://symfony.com/cve-2026-45073...
TYPO3-EXT-SA-2026-025: Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...
TYPO3-EXT-SA-2026-024: Information Disclosure in extension "femanager" (femanager)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...
TYPO3-EXT-SA-2026-019: Broken Access Control in extension "Club Directory" (clubdirectory)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-019...
Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...
Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
EasyAdmin's FileField and ImageField accept browser-executable file types by default FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG. When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin...
Fixes redirect uri validation in oauth
More info at https://github.com/FriendsOfSymfony/oauth2-php/releases/tag/1.3.0...
E-mail HTML injection
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Security Misconfiguration for Backend User Accounts
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-002...
Denial of Service in Online Media Asset Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-011...
By-passing Protection of PharStreamWrapper Interceptor
More info at https://typo3.org/security/advisory/typo3-psa-2018-001...
Magento 2.2.5 and 2.1.14 Security update
More info at https://magento.com/security/patches/magento-2.2.5-and-2.1.14-security-update...
SS-2018-004: XSS Vulnerability via WYSIWYG editor
More info at https://www.silverstripe.org/download/security-releases/ss-2018-004/...
XSS in class documenting_xmlrpc_server
More info at https://github.com/gggeek/phpxmlrpc-extras/releases/tag/0.6.1...
SS-2017-005: User enumeration via timing attack on login and password reset forms
More info at https://www.silverstripe.org/download/security-releases/ss-2017-005/...
EZSA-2017-006 Information disclosure in backend content tree menu
More info at http://share.ez.no/community-project/security-advisories/ezsa-2017-006-information-disclosure-in-backend-content-tree-menu...