Tagged “composer”
CVEs tagged composer, newest first.
560 CVEsRSS
CVE-2026-48067Medium· 6.5Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
CVE-2026-47767MediumSymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
CVE-2026-48030Critical· 9.9PoCPheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
CVE-2026-52778Critical· 9.8YesWiki is a wiki system written in PHP
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formu…
CVE-2026-45034CriticalPoCPHPSpreadsheet has a patch bypass for CVE-2026-34084
PHPSpreadsheet has a patch bypass for CVE-2026-34084
CVE-2026-47693Medium· 6.9Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
CVE-2026-54458Critical· 9.6WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
CVE-2026-27892Medium· 6.5FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download
CVE-2026-27964Low· 3.9FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
CVE-2026-40863High· 7.5PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
CVE-2026-40176High· 7.8PoCComposer is vulnerable to Command Injection via Malicious Perforce Repository
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supp…
CVE-2026-34036Medium· 6.5PoCDolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local File Inclusion (LFI) vulnerability in the core AJAX endpoint /core/ajax/selecto…
CVE-2026-56341High· 7.5AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
CVE-2026-56346MediumAVideo has Unauthenticated PGP Message Decryption via Public Endpoint
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint
CVE-2026-32267HighCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
CVE-2026-31887HighShopware: Unauthenticated data extraction possible through store-api.order endpoint
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
CVE-2025-69277Medium· 4.5libsodium has Incomplete List of Disallowed Inputs
libsodium has Incomplete List of Disallowed Inputs
CVE-2025-58048Critical· 9.9Paymenter is a free and open-source webshop solution for hostings
Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive…
GHSA-pgj4-g5j4-cmfxHigh· 7.0Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction
Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction
CVE-2022-23064High· 8.8snipe-IT vulnerable to host header injection
snipe-IT vulnerable to host header injection