---
title: "Critical Composer (PHP) advisories (page 2)"
url: https://erroneo.us/security/ecosystem/composer/2/
description: "All 244 critical GitHub-reviewed Composer (PHP) security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 2 of 3."
type: ecosystem
section: "Security Digest"
date_modified: 2026-03-12
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Composer (PHP) advisories (page 2)

- 2026-03-12 [CVE-2026-27591](https://erroneo.us/security/cve/CVE-2026-27591/index.md) Winter vulnerable to privilege escalation by authenticated backend users — winter/wn-backend-module >= 1.2.0, < 1.2.12 → 1.2.12; winter/wn-backend-module >= 1.1.0, < 1.1.12 → 1.1.12; winter/wn-backend-module < 1.0.477 → 1.0.477
- 2026-03-03 [CVE-2026-28697](https://erroneo.us/security/cve/CVE-2026-28697/index.md) Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates — craftcms/cms >= 5.0.0-RC1, < 5.9.0-beta.1 → 5.9.0-beta.1; craftcms/cms >= 4.0.0-RC1, < 4.17.0-beta.1 → 4.17.0-beta.1
- 2026-03-03 [CVE-2026-29058](https://erroneo.us/security/cve/CVE-2026-29058/index.md) WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php — wwbn/avideo < 7.0.0 → 7.0.0
- 2026-03-03 [CVE-2026-26279](https://erroneo.us/security/cve/CVE-2026-26279/index.md) Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection — froxlor/froxlor <= 2.3.3 → 2.3.4
- 2026-03-03 [CVE-2026-27012](https://erroneo.us/security/cve/CVE-2026-27012/index.md) OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php — devcode-it/openstamanager <= 2.9.8 → no fix
- 2026-03-02 [CVE-2026-28502](https://erroneo.us/security/cve/CVE-2026-28502/index.md) AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction — wwbn/avideo < 21.0 → no fix
- 2026-03-02 [CVE-2026-28501](https://erroneo.us/security/cve/CVE-2026-28501/index.md) AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php — wwbn/avideo <= 21.0.0 → no fix
- 2026-03-02 [CVE-2026-28508](https://erroneo.us/security/cve/CVE-2026-28508/index.md) Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint — idno/known <= 1.6.3 → 1.6.4
- 2026-02-24 [CVE-2026-27593](https://erroneo.us/security/cve/CVE-2026-27593/index.md) Statamic is vulnerable to account takeover via password reset link injection — statamic/cms < 5.73.10 → 5.73.10; statamic/cms >= 6.0.0-alpha.1, < 6.7.1 → 6.7.1
- 2026-02-17 [CVE-2026-26016](https://erroneo.us/security/cve/CVE-2026-26016/index.md) Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization — pterodactyl/panel < 1.12.1 → 1.12.1
- 2026-02-13 [CVE-2026-26273](https://erroneo.us/security/cve/CVE-2026-26273/index.md) Known affected by Account Takeover via Password Reset Token Leakage — idno/known <= 1.6.2 → 1.6.3
- 2026-02-06 [CVE-2025-69212](https://erroneo.us/security/cve/CVE-2025-69212/index.md) OpenSTAManager has an OS Command Injection in P7M File Processing — devcode-it/openstamanager <= 2.9.8 → no fix
- 2026-02-02 [CVE-2026-25510](https://erroneo.us/security/cve/CVE-2026-25510/index.md) CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor — ci4-cms-erp/ci4ms < 0.28.5.0 → 0.28.5.0
- 2026-01-21 [CVE-2026-23524](https://erroneo.us/security/cve/CVE-2026-23524/index.md) Laravel Redis Horizontal Scaling Insecure Deserialization — laravel/reverb < 1.7.0 → 1.7.0
- 2025-12-17 [CVE-2025-67165](https://erroneo.us/security/cve/CVE-2025-67165/index.md) Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component — pagekit/pagekit <= 1.0.18 → no fix
- 2025-12-17 [CVE-2025-67164](https://erroneo.us/security/cve/CVE-2025-67164/index.md) Pagekit CMS is vulnerable to OS Command Injection via Storage component — pagekit/pagekit <= 1.0.18 → no fix
- 2025-12-15 [CVE-2025-66844](https://erroneo.us/security/cve/CVE-2025-66844/index.md) Grav may be vulnerable to SSRF attack via Twig Templates — getgrav/grav <= 1.7.49.5 → no fix
- 2025-12-12 [CVE-2025-65854](https://erroneo.us/security/cve/CVE-2025-65854/index.md) MineAdmin has an insecure default password — mineadmin/mineadmin <= 3.0.9 → no fix
- 2025-12-10 [CVE-2025-67719](https://erroneo.us/security/cve/CVE-2025-67719/index.md) Ibexa User Bundle is missing password change validation — ibexa/user >= 5.0.0-beta1, < 5.0.4 → 5.0.4
- 2025-12-09 [CVE-2025-67510](https://erroneo.us/security/cve/CVE-2025-67510/index.md) Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”) — neuron-core/neuron-ai <= 2.8.11 → 2.8.12
- 2025-12-09 [GHSA-5j8p-438x-rgg5](https://erroneo.us/security/ghsa/GHSA-5j8p-438x-rgg5/index.md) SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475 — onelogin/php-saml < 2.21.1 → 2.21.1; onelogin/php-saml >= 3.0.0, < 3.8.1 → 3.8.1; onelogin/php-saml >= 4.0.0, < 4.3.1 → 4.3.1
- 2025-12-02 [CVE-2025-13828](https://erroneo.us/security/cve/CVE-2025-13828/index.md) Mautic user without privileged access to the Marketplace can install and uninstall composer packages — mautic/core >= 4.0.0, < 4.4.18 → 4.4.18; mautic/core >= 5.0.0, < 5.2.9 → 5.2.9; mautic/core >= 6.0.0, < 6.0.7 → 6.0.7
- 2025-10-16 [CVE-2025-62417](https://erroneo.us/security/cve/CVE-2025-62417/index.md) bagisto has CSV Formula Injection in Create New Product — bagisto/bagisto <= 2.3.7 → 2.3.8
- 2025-10-16 [CVE-2025-61922](https://erroneo.us/security/cve/CVE-2025-61922/index.md) PrestaShop Checkout allows customer account takeover via email — prestashop/ps_checkout >= 5.0.0, < 5.0.5 → 5.0.5; prestashop/ps_checkout >= 1.3.0, < 4.4.1 → 4.4.1
- 2025-10-08 [CVE-2025-10352](https://erroneo.us/security/cve/CVE-2025-10352/index.md) Melis Platform CMS Unauthenticated Admin Account Creation — melisplatform/melis-core < 5.3.11 → 5.3.11
- 2025-10-08 [CVE-2025-10351](https://erroneo.us/security/cve/CVE-2025-10351/index.md) Melis Platform CMS SQL Injection — melisplatform/melis-cms < 5.3.4 → 5.3.4
- 2025-10-08 [CVE-2025-10353](https://erroneo.us/security/cve/CVE-2025-10353/index.md) Melis Platform CMS Unauthenticated File Upload Leading to RCE — melisplatform/melis-cms-slider < 5.3.1 → 5.3.1
- 2025-09-09 [CVE-2025-54236](https://erroneo.us/security/cve/CVE-2025-54236/index.md) Magento Community Edition Improper Input Validation vulnerability — magento/community-edition <= 2.4.5-p14 → no fix; magento/community-edition = 2.4.6 → no fix; magento/community-edition >= 2.4.6-p1, <= 2.4.6-p12 → no fix
- 2025-08-27 [CVE-2025-52122](https://erroneo.us/security/cve/CVE-2025-52122/index.md) The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability — solspace/craft-freeform >= 5.0.0, < 5.10.16 → 5.10.16
- 2025-08-05 [CVE-2025-50706](https://erroneo.us/security/cve/CVE-2025-50706/index.md) ThinkPHP Path Traversal Vulnerability — topthink/framework <= 5.1.41 → no fix
- 2025-08-04 [CVE-2025-54119](https://erroneo.us/security/cve/CVE-2025-54119/index.md) The ADOdb sqlite3 driver allows SQL injection — adodb/adodb-php <= 5.22.9 → 5.22.10
- 2025-07-28 [CVE-2025-54418](https://erroneo.us/security/cve/CVE-2025-54418/index.md) CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability — codeigniter4/framework < 4.6.2 → 4.6.2
- 2025-07-21 [CVE-2025-54082](https://erroneo.us/security/cve/CVE-2025-54082/index.md) nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability — marshmallow/nova-tiptap < 5.7.0 → 5.7.0; manogi/nova-tiptap <= 3.2.6 → no fix
- 2025-07-18 [CVE-2025-46001](https://erroneo.us/security/cve/CVE-2025-46001/index.md) simogeo/filemanager arbitrary file upload vulnerability — simogeo/filemanager < 2.5.0 → no fix
- 2025-07-17 [CVE-2025-54068](https://erroneo.us/security/cve/CVE-2025-54068/index.md) Livewire is vulnerable to remote command execution during component property update hydration — livewire/livewire >= 3.0.0-beta.1, < 3.6.4 → 3.6.4
- 2025-07-14 [CVE-2025-53833](https://erroneo.us/security/cve/CVE-2025-53833/index.md) LaRecipe is vulnerable to Server-Side Template Injection attacks — binarytorch/larecipe < 2.8.1 → 2.8.1
- 2025-06-19 [CVE-2025-49132](https://erroneo.us/security/cve/CVE-2025-49132/index.md) Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution — pterodactyl/panel <= 1.11.10 → 1.11.11
- 2025-06-10 [CVE-2025-47110](https://erroneo.us/security/cve/CVE-2025-47110/index.md) Magneto contains stored XSS vulnerability — magento/community-edition >= 2.4.8-beta1, < 2.4.8-p1 → 2.4.8-p1; magento/community-edition >= 2.4.7-beta1, < 2.4.7-p6 → 2.4.7-p6; magento/community-edition < 2.4.5-p13 → 2.4.5-p13
- 2025-06-06 [GHSA-c42h-56wx-h85q](https://erroneo.us/security/ghsa/GHSA-c42h-56wx-h85q/index.md) laravel-auth0 SDK Deserialization of Untrusted Data vulnerability — auth0/login >= 7.0.0-BETA1, <= 7.2.1 → 7.2.2
- 2025-06-05 [GHSA-98j6-67v3-mw34](https://erroneo.us/security/ghsa/GHSA-98j6-67v3-mw34/index.md) Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability — auth0/symfony >= 5.0.0-BETA0, <= 5.0.0 → 5.1.0
- 2025-06-04 [CVE-2025-48951](https://erroneo.us/security/cve/CVE-2025-48951/index.md) Auth0-PHP SDK Deserialization of Untrusted Data vulnerability — auth0/auth0-php >= 8.0.0-BETA3, < 8.3.1 → 8.3.1
- 2025-06-04 [GHSA-862m-5253-832r](https://erroneo.us/security/ghsa/GHSA-862m-5253-832r/index.md) Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data — auth0/wordpress >= 5.0.0-BETA0, <= 5.0.1 → 5.1.0
- 2025-06-01 [CVE-2025-49113](https://erroneo.us/security/cve/CVE-2025-49113/index.md) Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization — roundcube/roundcubemail < 1.5.10 → 1.5.10; roundcube/roundcubemail >= 1.6.0, < 1.6.11 → 1.6.11
- 2025-05-21 [CVE-2025-48200](https://erroneo.us/security/cve/CVE-2025-48200/index.md) The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution — sjbr/sr-feuser-register >= 5.1.0, < 12.5.0 → 12.5.0
- 2025-05-17 [GHSA-9wg9-93h9-j8ch](https://erroneo.us/security/ghsa/GHSA-9wg9-93h9-j8ch/index.md) Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions — auth0/symfony < 5.4.0 → 5.4.0
- 2025-05-17 [GHSA-9fwj-9mjf-rhj3](https://erroneo.us/security/ghsa/GHSA-9fwj-9mjf-rhj3/index.md) laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions — auth0/login < 7.17.0 → 7.17.0
- 2025-05-17 [GHSA-2f4r-34m4-3w8q](https://erroneo.us/security/ghsa/GHSA-2f4r-34m4-3w8q/index.md) Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions — auth0/wordpress < 5.3.0 → 5.3.0
- 2025-05-16 [CVE-2025-47275](https://erroneo.us/security/cve/CVE-2025-47275/index.md) Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK — auth0/auth0-php >= 8.0.0-BETA1, < 8.14.0 → 8.14.0
- 2025-05-01 [CVE-2025-46337](https://erroneo.us/security/cve/CVE-2025-46337/index.md) SQL injection in ADOdb PostgreSQL driver pg_insert_id() method — adodb/adodb-php <= 5.22.8 → 5.22.9
- 2025-04-29 [CVE-2025-46348](https://erroneo.us/security/cve/CVE-2025-46348/index.md) YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download — yeswiki/yeswiki <= 4.5.3 → 4.5.4
- 2025-04-29 [CVE-2025-0520](https://erroneo.us/security/cve/CVE-2025-0520/index.md) ShowDoc unrestricted file upload vulnerability — showdoc/showdoc < 2.8.7 → 2.8.7
- 2025-04-25 [CVE-2025-32432](https://erroneo.us/security/cve/CVE-2025-32432/index.md) Craft CMS Allows Remote Code Execution — craftcms/cms >= 3.0.0-RC1, <= 3.9.14 → 3.9.15; craftcms/cms >= 4.0.0-RC1, <= 4.14.14 → 4.14.15; craftcms/cms >= 5.0.0-RC1, <= 5.6.16 → 5.6.17
- 2025-04-14 [CVE-2025-32931](https://erroneo.us/security/cve/CVE-2025-32931/index.md) DevDojo Voyager Argument Injection vulnerability — tcg/voyager >= 1.4.0, <= 1.8.0 → no fix
- 2025-04-09 [CVE-2024-58136](https://erroneo.us/security/cve/CVE-2024-58136/index.md) yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key — yiisoft/yii2 < 2.0.52 → 2.0.52
- 2025-04-08 [CVE-2025-22871](https://erroneo.us/security/cve/CVE-2025-22871/index.md) RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency — spiral/roadrunner < 2025.1.0 → 2025.1.0
- 2025-03-05 [CVE-2025-27517](https://erroneo.us/security/cve/CVE-2025-27517/index.md) Volt Allows RCE Via User-Crafted Requests — livewire/volt < 1.7.0 → 1.7.0
- 2025-02-26 [CVE-2024-47051](https://erroneo.us/security/cve/CVE-2024-47051/index.md) Mautic allows Remote Code Execution and File Deletion in Asset Uploads — mautic/core < 5.2.3 → 5.2.3
- 2025-02-12 [GHSA-c2p2-hgjg-9r3f](https://erroneo.us/security/ghsa/GHSA-c2p2-hgjg-9r3f/index.md) Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header — islandora/crayfish <= 4.0.0 → no fix
- 2025-02-12 [CVE-2024-57602](https://erroneo.us/security/cve/CVE-2024-57602/index.md) Easy!Appointments Improper Restriction of Excessive Authentication Attempts — alextselegidis/easyappointments <= 1.5.0 → no fix
- 2025-02-11 [CVE-2025-24434](https://erroneo.us/security/cve/CVE-2025-24434/index.md) Improper Authorization vulnerability in Magento and Adobe Commerce — magento/community-edition >= 2.4.8-beta1, < 2.4.8-beta2 → 2.4.8-beta2; magento/community-edition >= 2.4.7-beta1, < 2.4.7-p4 → 2.4.7-p4; magento/community-edition >= 2.4.6-p1, < 2.4.6-p9 → 2.4.6-p9
- 2025-02-06 [GHSA-vrpv-vw92-328g](https://erroneo.us/security/ghsa/GHSA-vrpv-vw92-328g/index.md) Multiple rtmpdump vulnerabilities — rudloff/rtmpdump-bin <= 2.3.1 → no fix
- 2025-01-15 [CVE-2025-25286](https://erroneo.us/security/cve/CVE-2025-25286/index.md) Crayfish allows Remote Code Execution via Homarus Authorization header — islandora/crayfish < 4.1.0 → 4.1.0
- 2024-12-30 [CVE-2024-50703](https://erroneo.us/security/cve/CVE-2024-50703/index.md) TeamPass privileges issue — nilsteampassnet/teampass < 3.1.3.1 → 3.1.3.1
- 2024-12-18 [CVE-2024-56145](https://erroneo.us/security/cve/CVE-2024-56145/index.md) Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled — craftcms/cms >= 5.0.0-RC1, < 5.5.2 → 5.5.2; craftcms/cms >= 4.0.0-RC1, < 4.13.2 → 4.13.2; craftcms/cms >= 3.0.0, < 3.9.14 → 3.9.14
- 2024-11-15 [CVE-2024-51092](https://erroneo.us/security/cve/CVE-2024-51092/index.md) LibreNMS has an Authenticated OS Command Injection — librenms/librenms <= 24.9.1 → 24.10.0
- 2024-11-15 [CVE-2021-3838](https://erroneo.us/security/cve/CVE-2021-3838/index.md) Deserialization of Untrusted Data in dompdf/dompdf — dompdf/dompdf < 2.0.0 → 2.0.0
- 2024-11-15 [CVE-2021-3902](https://erroneo.us/security/cve/CVE-2021-3902/index.md) Improper Restriction of XML External Entity Reference in dompdf/dompdf — dompdf/dompdf < 2.0.0 → 2.0.0
- 2024-09-09 [CVE-2024-44902](https://erroneo.us/security/cve/CVE-2024-44902/index.md) ThinkPHP deserialization vulnerability — topthink/framework >= 6.1.3, <= 8.0.4 → no fix
- 2024-07-29 [CVE-2024-38529](https://erroneo.us/security/cve/CVE-2024-38529/index.md) Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment — admidio/admidio < 4.3.10 → 4.3.10
- 2024-07-29 [CVE-2024-37906](https://erroneo.us/security/cve/CVE-2024-37906/index.md) Admidio has Blind SQL Injection in ecard_send.php — admidio/admidio < 4.3.9 → 4.3.9
- 2024-07-28 [CVE-2024-41637](https://erroneo.us/security/cve/CVE-2024-41637/index.md) RaspAP allows an attacker to escalate privileges — billz/raspap-webgui <= 3.1.4 → no fix
- 2024-07-15 [CVE-2024-40624](https://erroneo.us/security/cve/CVE-2024-40624/index.md) TorrentPier Deserialization of Untrusted Data vulnerability — torrentpier/torrentpier <= 2.4.3 → 2.4.4
- 2024-06-25 [CVE-2024-37843](https://erroneo.us/security/cve/CVE-2024-37843/index.md) Craft CMS SQL injection vulnerability via the GraphQL API endpoint — craftcms/cms <= 3.7.31 → no fix
- 2024-06-13 [CVE-2024-34102](https://erroneo.us/security/cve/CVE-2024-34102/index.md) Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability — magento/community-edition = 2.4.4 → no fix; magento/community-edition >= 2.4.6-p1, < 2.4.6-p6 → 2.4.6-p6; magento/community-edition >= 2.4.5-p1, < 2.4.5-p8 → 2.4.5-p8
- 2024-06-13 [CVE-2024-34103](https://erroneo.us/security/cve/CVE-2024-34103/index.md) Magento Open Source Improper Authentication vulnerability — magento/community-edition = 2.4.7 → no fix; magento/community-edition = 2.4.6 → no fix; magento/community-edition = 2.4.5 → no fix
- 2024-06-07 [GHSA-x86x-qhf8-f37w](https://erroneo.us/security/ghsa/GHSA-x86x-qhf8-f37w/index.md) willdurand/js-translation-bundle potential path traversal attack and remote code injection — willdurand/js-translation-bundle < 2.1.1 → 2.1.1
- 2024-06-07 [GHSA-v42g-7q2x-cw32](https://erroneo.us/security/ghsa/GHSA-v42g-7q2x-cw32/index.md) Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) — zendframework/zendframework1 >= 1.12.0, < 1.12.16 → 1.12.16
- 2024-06-07 [GHSA-qf36-fx9f-232x](https://erroneo.us/security/ghsa/GHSA-qf36-fx9f-232x/index.md) ZendFramework potential SQL Injection Vector When Using PDO_MySql — zendframework/zendframework1 >= 1.10.0, < 1.10.9 → 1.10.9; zendframework/zendframework1 >= 1.11.0, < 1.11.6 → 1.11.6
- 2024-06-07 [GHSA-qc7w-4567-84wv](https://erroneo.us/security/ghsa/GHSA-qc7w-4567-84wv/index.md) Zendframework vulnerable to XXE/XEE attacks — zendframework/zendframework >= 2.1.0, < 2.1.6 → 2.1.6; zendframework/zendframework >= 2.2.0, < 2.2.6 → 2.2.6
- 2024-06-07 [GHSA-mhpx-3rv8-wrjm](https://erroneo.us/security/ghsa/GHSA-mhpx-3rv8-wrjm/index.md) ZendFramework potential XML eXternal Entity injection vectors — zendframework/zendframework1 >= 1.12.0, < 1.12.4 → 1.12.4
- 2024-06-07 [GHSA-f4fj-q6m4-cc52](https://erroneo.us/security/ghsa/GHSA-f4fj-q6m4-cc52/index.md) ZendFramework vulnerable to XXE/XEE attacks — zendframework/zend-xmlrpc >= 2.1.0, < 2.1.6 → 2.1.6; zendframework/zend-xmlrpc >= 2.2.0, < 2.2.6 → 2.2.6
- 2024-06-07 [GHSA-8x2v-pcg7-94f4](https://erroneo.us/security/ghsa/GHSA-8x2v-pcg7-94f4/index.md) Zend-JSON vulnerable to XXE/XEE attacks — zendframework/zend-json >= 2.1.0, < 2.1.6 → 2.1.6; zendframework/zend-json >= 2.2.0, < 2.2.6 → 2.2.6
- 2024-06-07 [GHSA-6fqw-j3vm-7f66](https://erroneo.us/security/ghsa/GHSA-6fqw-j3vm-7f66/index.md) Zendframework1 Potential SQL injection in ORDER and GROUP functions — zendframework/zendframework1 < 1.12.20 → 1.12.20
- 2024-06-07 [GHSA-2x36-qhx3-7m5f](https://erroneo.us/security/ghsa/GHSA-2x36-qhx3-7m5f/index.md) ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select — zendframework/zendframework1 >= 1.12.0, < 1.12.7 → 1.12.7
- 2024-06-05 [GHSA-gwfx-p7mr-f92v](https://erroneo.us/security/ghsa/GHSA-gwfx-p7mr-f92v/index.md) Missing Access Check in TYPO3 CMS — typo3/cms >= 6.2.0, < 6.2.25 → 6.2.25; typo3/cms >= 7.6.0, < 7.6.8 → 7.6.8; typo3/cms >= 8.0.0, < 8.1.1 → 8.1.1
- 2024-06-05 [GHSA-67wg-6j7r-mqh8](https://erroneo.us/security/ghsa/GHSA-67wg-6j7r-mqh8/index.md) Arbitrary Code Execution in TYPO3 CMS — typo3/cms >= 7.6.0, < 7.6.22 → 7.6.22; typo3/cms >= 8.0.0, < 8.7.5 → 8.7.5
- 2024-05-30 [GHSA-q3jm-v27q-jfww](https://erroneo.us/security/ghsa/GHSA-q3jm-v27q-jfww/index.md) titon/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack — titon/framework <= 0.1.0-alpha → no fix
- 2024-05-30 [GHSA-mmcv-fvq8-r9x3](https://erroneo.us/security/ghsa/GHSA-mmcv-fvq8-r9x3/index.md) Symfony XML decoding attack vector through external entities — symfony/symfony >= 2.0.0, < 2.0.11 → 2.0.11
- 2024-05-30 [GHSA-cc97-g92w-jm65](https://erroneo.us/security/ghsa/GHSA-cc97-g92w-jm65/index.md) TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution — typo3/cms-core >= 8.0.0, < 8.7.17 → 8.7.17; typo3/cms-core >= 9.0.0, < 9.3.2 → 9.3.2; typo3/cms-core >= 7.0.0, < 7.6.30 → 7.6.30
- 2024-05-29 [GHSA-j68w-pg49-f6vx](https://erroneo.us/security/ghsa/GHSA-j68w-pg49-f6vx/index.md) Symfony XML decoding attack vector through external entities — symfony/serializer >= 2.0.0, < 2.0.11 → 2.0.11
- 2024-05-29 [GHSA-4qpj-gxxg-jqg4](https://erroneo.us/security/ghsa/GHSA-4qpj-gxxg-jqg4/index.md) Swiftmailer Sendmail transport arbitrary shell execution — swiftmailer/swiftmailer >= 4.0.0, < 5.2.1 → 5.2.1
- 2024-05-24 [CVE-2024-5315](https://erroneo.us/security/cve/CVE-2024-5315/index.md) Dolibarr vulnerable to SQL Injection — dolibarr/dolibarr <= 9.0.1 → no fix
- 2024-05-24 [CVE-2024-5314](https://erroneo.us/security/cve/CVE-2024-5314/index.md) Dolibarr vulnerable to SQL Injection — dolibarr/dolibarr <= 9.0.1 → no fix
- 2024-05-23 [GHSA-8v6m-7f5v-hhx6](https://erroneo.us/security/ghsa/GHSA-8v6m-7f5v-hhx6/index.md) Silverstripe Brute force bypass on default admin — silverstripe/framework >= 3.1.18, < 3.1.19 → 3.1.19; silverstripe/framework >= 3.2.3, < 3.2.4 → 3.2.4; silverstripe/framework >= 3.3.1, < 3.3.2 → 3.3.2
- 2024-05-22 [CVE-2024-25738](https://erroneo.us/security/cve/CVE-2024-25738/index.md) VuFind Server-Side Request Forgery (SSRF) vulnerability — vufind/vufind >= 2.0, < 9.1.1 → 9.1.1
- 2024-05-22 [CVE-2024-25737](https://erroneo.us/security/cve/CVE-2024-25737/index.md) VuFind Server-Side Request Forgery (SSRF) vulnerability — vufind/vufind >= 2.4, < 9.1.1 → 9.1.1
- 2024-05-21 [GHSA-q3g4-2vw9-xv27](https://erroneo.us/security/ghsa/GHSA-q3g4-2vw9-xv27/index.md) Shopware Remote Code Execution Vulnerability — shopware/shopware >= 4.0.0, < 5.2.15 → 5.2.15; shopware/shopware < 1.0.8 → 1.0.8
- 2024-05-21 [GHSA-83jv-4prm-34g7](https://erroneo.us/security/ghsa/GHSA-83jv-4prm-34g7/index.md) Shopware Remote Code Execution Vulnerability — shopware/shopware >= 4.2.0, < 5.2.25 → 5.2.25
- 2024-05-21 [GHSA-7336-ghhp-f2qj](https://erroneo.us/security/ghsa/GHSA-7336-ghhp-f2qj/index.md) Shopware Remote Code Execution Vulnerability — shopware/shopware = 5.2.15 → 5.2.16
- 2024-05-20 [GHSA-7vw7-qx38-37vr](https://erroneo.us/security/ghsa/GHSA-7vw7-qx38-37vr/index.md) Propel2 SQL injection possible with limit() on MySQL — propel/propel >= 2.0.0-alpha1, <= 2.0.0-alpha7 → 2.0.0-alpha8

Pages: https://erroneo.us/security/ecosystem/composer/index.md · https://erroneo.us/security/ecosystem/composer/2/index.md · https://erroneo.us/security/ecosystem/composer/3/index.md

---
Source page: https://erroneo.us/security/ecosystem/composer/2/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt