Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2023-39529Mediumprestashop/prestashop: PrestaShop file deletion via attachment API CVE-2023-39528Mediumprestashop/prestashop: PrestaShop file access through path traversal CVE-2023-39527Highprestashop/prestashop: PrestaShop XSS injection through Validate::isCleanHTML method CVE-2023-39526Criticalprestashop/prestashop: PrestaShop SQL manager vulnerability CVE-2023-39525Mediumprestashop/prestashop: PrestaShop path traversal CVE-2023-39524Mediumprestashop/prestashop: PrestaShop boolean SQL injection CVE-2023-38209Mediummagento/community-edition: Magento Open Source allows Incorrect Authorization CVE-2023-38207Lowmagento/community-edition: Magento Open Source allows XML Injection CVE-2023-38208Highmagento/community-edition: Magento Open Source allows Improper Neutralization of Special Elements Used CVE-2023-4196Highcockpit-hq/cockpit: Cockpit Cross-site Scripting vulnerability CVE-2023-4195Criticalcockpit-hq/cockpit: Cockpit PHP Remote File Inclusion vulnerability CVE-2023-4190Mediumadmidio/admidio: Admidio Insufficient Session Expiration vulnerability CVE-2023-4157Mediumomeka/omeka-s: omeka/omeka-s Improper Input Validation vulnerability CVE-2023-29689Criticalpyrocms/pyrocms: PyroCMS remote code execution vulnerability CVE-2023-39343Mediumsulu/sulu: Sulu Observable Response Discrepancy on Admin Login CVE-2023-38708Mediumpimcore/pimcore: Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction CVE-2023-4145Mediumpimcore/customer-management-framework-bundle: pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name CVE-2022-39987Highbillz/raspap-webgui: RaspAP Command Injection vulnerability CVE-2022-39986Criticalbillz/raspap-webgui: RaspAP Command Injection vulnerability GHSA-4Q66-G4MM-8RG5Mediumsilverstripe/admin: Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE CVE-2023-32302Lowsilverstripe/framework: Silverstripe Framework: Members with no password can be created and bypass custom login forms CVE-2023-4006Highthorsten/phpmyfaq: phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability CVE-2023-4007Highthorsten/phpmyfaq: phpMyFAQ Stored Cross-site Scripting vulnerability CVE-2023-38488Highgetkirby/cms: Field injection in the KirbyData text storage handler CVE-2023-38489Highgetkirby/cms: Insufficient Session Expiration after a password change

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo