CVE-2024-54775

The Dcat-Admin backend system builder, specifically versions v2.2.0-beta and v2.2.2-beta , is susceptible to a Cross-Site Scripting (XSS) vulnerability. The flaw exists in the improper neutralization of input during web page generation, reachable via the /admin/auth/menu and /admin/auth/extension...

CVE-2023-33736

CVE-2023-33736 is a stored XSS vulnerability in Dcat-Admin v2.1.3-beta, exploitable via a crafted payload injected into a URL parameter. The impact is arbitrary web script/HTML execution as described; no explicit fix/version in the provided documents. Connected sources reference advisories and ex...

CVE-2024-29644

A Cross Site Scripting (XSS) vulnerability exists in dcat-admin versions 2.1.3 and earlier . A remote attacker can exploit this flaw by using a crafted script targeting the user login box , which may allow for the execution of arbitrary code and unauthorized actions on the affected system. To rem...

CVE-2024-54774

Dcat Admin version v2.2.0-beta is vulnerable to a cross-site scripting (XSS) vulnerability within the /admin/articles/create endpoint. The root cause is the lack of effective filtering and escaping of user-supplied data, which allows an attacker to execute arbitrary web scripts or HTML by injecti...

CVE-2025-0709

CVE-2025-0709 affects Dcat-Admin 2.2.1-beta, specifically the Roles Page component at /admin/auth/roles. Root cause: cross-site scripting (XSS) via manipulation of input on that page; exploitation can be remote and has been disclosed publicly. Multiple sources (NVD, Red Hat, OSV, CVELIST, vulnbod...

CVE-2025-65656

The dcat-admin package (v2.2.3-beta and before) is vulnerable to file inclusion within the admin/src/Extend/VersionManager.php component. The root cause is an Unsafe Dependency Resolution during the extension upload process, where an attacker can supply crafted input to the file inclusion mechani...