Composer vulnerabilities

CVE-2025-49113 High · 8.8 KEV Urgent · 76 Public exploit CWE-502 Jun 2, 2025

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

CVE-2025-35939 Medium · 5.3 KEV High · 52 CWE-472 May 7, 2025

Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.

CVE-2025-32432 Critical · 10.0 KEV Urgent · 83 Public exploit CWE-94 Apr 25, 2025

Craft CMS Code Injection Vulnerability

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

CVE-2024-58136 Critical · 9.8 KEV High · 64 Public exploit CWE-424 Apr 10, 2025

Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

CVE-2025-23209 High · 8.1 KEV High · 56 CWE-94 Jan 17, 2025

Craft CMS Code Injection Vulnerability

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

CVE-2024-56145 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-94 Dec 18, 2024

Craft CMS Code Injection Vulnerability

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.

CVE-2024-34102 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-611 Jun 13, 2024

Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

CVE-2022-24086 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-20 Feb 16, 2022

Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

CVE-2021-32648 Critical · 9.1 KEV Urgent · 73 Public exploit CWE-287 Aug 26, 2021

October CMS Improper Authentication

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

CVE-2021-21311 High · 7.2 KEV High · 69 Public exploit CWE-918 Feb 11, 2021

Adminer Server-Side Request Forgery Vulnerability

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.

CVE-2020-36193 High · 7.5 KEV High · 59 CWE-22 Jan 18, 2021

PEAR Archive_Tar Improper Link Resolution Vulnerability

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

CVE-2021-3129 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware Jan 12, 2021

Laravel Ignition File Upload Vulnerability

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

CVE-2020-13671 High · 8.8 KEV High · 62 Public exploit CWE-434 Nov 20, 2020

Drupal core Un-restricted Upload of File

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

CVE-2020-28949 High · 7.8 KEV High · 68 Public exploit Nov 19, 2020

PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

CVE-2020-11023 Medium · 6.1 KEV High · 67 Public exploit CWE-79 Apr 29, 2020

JQuery Cross-Site Scripting (XSS) Vulnerability

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2019-6340 High · 8.1 KEV Urgent · 76 Public exploit CWE-502 Feb 21, 2019

Drupal Core Remote Code Execution Vulnerability

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

CVE-2018-7600 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-20 Mar 29, 2018

Drupal Core Remote Code Execution Vulnerability

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

CVE-2017-9841 Critical · 9.8 KEV Urgent · 81 Public exploit CWE-94 Jun 27, 2017

PHPUnit Command Injection Vulnerability

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

CVE-2016-10033 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-88 Dec 30, 2016

PHPMailer Command Injection Vulnerability

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.