Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-52085Lowwinter/wn-backend-module: Winter CMS Local File Inclusion through Server Side Template Injection CVE-2023-52084Lowwinter/wn-backend-module: Winter CMS Stored XSS through Backend ColorPicker FormWidgetCVE-2023-52083Lowwinter/wn-system-module: Winter CMS Stored XSS through privileged upload of Media Manager file followed by renamingCVE-2023-48652Mediumconcrete5/concrete5: Concrete CMS Cross Site Request Forgery (CSRF)CVE-2023-51651Mediumaws/aws-sdk-php: Potential URI resolution path traversal in the AWS SDK for PHPCVE-2023-7038Mediumautomad/automad: Cross-Site Request Forgery (CSRF) in automad/automadCVE-2023-7037Lowautomad/automad: Authenticated Blind SSRF in automad/automadCVE-2023-38519Highmainwp/mainwp: MainWP Dashboard SQL Command Injection vulnerabilityCVE-2023-49006Mediumphpsysinfo/phpsysinfo: Phpsysinfo Cross Site Request Forgery (CSRF) vulnerabilityCVE-2014-125107Mediumcorveda/phpsandbox: Corveda PHPSandbox Protection Mechanism Failure vulnerabilityCVE-2023-50708Lowyiisoft/yii2-authclient: yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementationCVE-2023-50714Mediumyiisoft/yii2-authclient: yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerableCVE-2023-6890Mediumthorsten/phpmyfaq: phpMyFAQ Cross-site Scripting vulnerabilityCVE-2023-6889Mediumthorsten/phpmyfaq: phpMyFAQ Cross-site Scripting vulnerabilityCVE-2023-6832Mediummicroweber/microweber: Business Logic Errors in microweber/microweberCVE-2023-50462Mediumt3s/content-consent: Insecure Direct Object Reference in extension "Content Consent" (content_consent)CVE-2023-50459Mediumin2code/femanager: Broken Access Control in extension "femanager" CVE-2023-50461Highdirectmailteam/direct-mail: Configuration Injection in extension "Direct Mail" (direct_mail)CVE-2023-50262Mediumdompdf/dompdf: Denial of service caused by infinite recursion when parsing SVG imagesCVE-2023-50251Mediumphenx/php-svg-lib: Denial of service caused by infinite recursion when parsing SVG documentCVE-2022-48614Mediummediawiki/semantic-media-wiki: Cross-site Scripting in Semantic MediaWikiCVE-2023-6654Mediumphpems/phpems: PHPEMS Deserialization of Untrusted Data vulnerabilityGHSA-9J5W-2CQC-CWJ9Highopenmage/magento-lts: Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG EditorCVE-2023-48122Highmicroweber/microweber: Microweber allows a remote attacker to obtain sensitive information via the HTTP GET methodCVE-2023-6599Lowmicroweber/microweber: Microweber missing standardized error handling mechanism

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo