---
title: "Critical Composer (PHP) advisories (page 3)"
url: https://erroneo.us/security/ecosystem/composer/3/
description: "All 244 critical GitHub-reviewed Composer (PHP) security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 3 of 3."
type: ecosystem
section: "Security Digest"
date_modified: 2024-05-20
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Composer (PHP) advisories (page 3)

- 2024-05-20 [GHSA-7g7c-qhf3-x59p](https://erroneo.us/security/ghsa/GHSA-7g7c-qhf3-x59p/index.md) propel/propel1 SQL injection possible with limit() on MySQL — propel/propel1 >= 1, <= 1.7.1 → 1.7.2
- 2024-05-17 [GHSA-rq6q-hjvh-5mwh](https://erroneo.us/security/ghsa/GHSA-rq6q-hjvh-5mwh/index.md) Flow Swift Mailer package Remote code execution — neos/swiftmailer < 5.4.5 → 5.4.5
- 2024-05-17 [GHSA-4rr6-gf59-ggw5](https://erroneo.us/security/ghsa/GHSA-4rr6-gf59-ggw5/index.md) namshi/jose - Verification bypass — namshi/jose < 2.2.0 → 2.2.0
- 2024-05-15 [GHSA-wxxw-5gq6-j2g5](https://erroneo.us/security/ghsa/GHSA-wxxw-5gq6-j2g5/index.md) contao/core Insufficient input validation allows for code injection and remote execution — contao/core >= 2.0.0, < 2.11.17 → 2.11.17; contao/core >= 3.0.0, < 3.2.9 → 3.2.9
- 2024-05-15 [GHSA-qm5c-m76r-2hfr](https://erroneo.us/security/ghsa/GHSA-qm5c-m76r-2hfr/index.md) Laravel RCE vulnerability in "cookie" session driver — laravel/framework >= 4.1.0, < 6.18.31 → 6.18.31; laravel/framework >= 7.0.0, < 7.22.4 → 7.22.4
- 2024-05-15 [GHSA-prpf-cj87-hwvr](https://erroneo.us/security/ghsa/GHSA-prpf-cj87-hwvr/index.md) Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities — magento/community-edition < 1.9.3.9 → 1.9.3.9
- 2024-05-15 [GHSA-jjx7-8462-w4m4](https://erroneo.us/security/ghsa/GHSA-jjx7-8462-w4m4/index.md) Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution — drupal/drupal >= 8.0.0, < 8.5.8 → 8.5.8; drupal/drupal >= 8.6.0, < 8.6.2 → 8.6.2
- 2024-05-15 [GHSA-jf8c-36vw-98x4](https://erroneo.us/security/ghsa/GHSA-jf8c-36vw-98x4/index.md) Drupal core Remote Code Execution — drupal/drupal >= 7.0, < 7.60 → 7.60; drupal/drupal >= 8.0.0, < 8.5.8 → 8.5.8; drupal/drupal >= 8.6.0, < 8.6.2 → 8.6.2
- 2024-05-15 [GHSA-h63c-xvpf-264j](https://erroneo.us/security/ghsa/GHSA-h63c-xvpf-264j/index.md) ADOdb SQL injection vulnerability — adodb/adodb-php < 5.20.11 → 5.20.11
- 2024-05-15 [GHSA-h533-5v22-8vcp](https://erroneo.us/security/ghsa/GHSA-h533-5v22-8vcp/index.md) firebase/php-jwt: "None" Algorithm treated as valid on tokens — firebase/php-jwt < 2.0.0 → 2.0.0
- 2024-05-15 [GHSA-cv25-3pxr-4q7x](https://erroneo.us/security/ghsa/GHSA-cv25-3pxr-4q7x/index.md) Magento Open Source Security Advisory: Patch SUPEE-10975 — magento/community-edition >= 1.9.0.0, < 1.14.4.0 → 1.14.4.0
- 2024-05-15 [GHSA-9gxv-x7rp-r2hc](https://erroneo.us/security/ghsa/GHSA-9gxv-x7rp-r2hc/index.md) gree/jose - "None" Algorithm treated as valid in tokens — gree/jose < 2.2.1 → 2.2.1
- 2024-05-15 [GHSA-8j7c-682x-r9f2](https://erroneo.us/security/ghsa/GHSA-8j7c-682x-r9f2/index.md) Magento RCE,XSS and other vulnerabilities — magento/community-edition >= 2.1, < 2.1.16 → 2.1.16; magento/community-edition >= 2.2, < 2.2.7 → 2.2.7
- 2024-05-15 [GHSA-7v68-3pr5-h3cr](https://erroneo.us/security/ghsa/GHSA-7v68-3pr5-h3cr/index.md) Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution — drupal/core >= 8.0.0, < 8.5.8 → 8.5.8; drupal/core >= 8.6.0, < 8.6.2 → 8.6.2
- 2024-05-15 [GHSA-6wm4-3rjj-c8xx](https://erroneo.us/security/ghsa/GHSA-6wm4-3rjj-c8xx/index.md) Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities — magento/community-edition >= 1.5.0.0, < 1.9.4.0 → 1.9.4.0
- 2024-05-15 [GHSA-6q9v-4hq6-5m67](https://erroneo.us/security/ghsa/GHSA-6q9v-4hq6-5m67/index.md) Doctrine SQL injection vulnerability — doctrine/orm >= 2.0.0, < 2.0.3 → 2.0.3; doctrine/orm >= 1.0.0, < 1.2.4 → 1.2.4
- 2024-05-15 [GHSA-6mgp-v5cm-ghg5](https://erroneo.us/security/ghsa/GHSA-6mgp-v5cm-ghg5/index.md) Drupal core Remote Code Execution — drupal/core >= 7.0, < 7.60 → 7.60; drupal/core >= 8.0.0, < 8.5.8 → 8.5.8; drupal/core >= 8.6.0, < 8.6.2 → 8.6.2
- 2024-05-15 [GHSA-5gmh-85x8-5cx7](https://erroneo.us/security/ghsa/GHSA-5gmh-85x8-5cx7/index.md) Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities — magento/community-edition >= 2.1, < 2.1.14 → 2.1.14; magento/community-edition >= 2.2, < 2.2.5 → 2.2.5
- 2024-05-15 [CVE-2020-35125](https://erroneo.us/security/cve/CVE-2020-35125/index.md) Mautic is vulnerable to XSS vulnerability — mautic/core < 2.16.5 → 2.16.5; mautic/core >= 3.0.0, < 3.2.4 → 3.2.4
- 2024-05-15 [GHSA-2ffv-r4r9-r8xr](https://erroneo.us/security/ghsa/GHSA-2ffv-r4r9-r8xr/index.md) Laravel RCE vulnerability in "cookie" session driver — illuminate/cookie >= 4.1.0, < 6.18.31 → 6.18.31; illuminate/cookie >= 7.0.0, < 7.22.4 → 7.22.4
- 2024-05-15 [GHSA-27qr-636m-wxg2](https://erroneo.us/security/ghsa/GHSA-27qr-636m-wxg2/index.md) codeigniter/framework SQL injection in ODBC database driver — codeigniter/framework < 3.1.0 → 3.1.0
- 2024-05-15 [GHSA-26hq-7286-mg8f](https://erroneo.us/security/ghsa/GHSA-26hq-7286-mg8f/index.md) Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability — magento/community-edition >= 1.9.0.0, < 1.14.3.2 → 1.14.3.2
- 2024-05-14 [CVE-2024-4825](https://erroneo.us/security/cve/CVE-2024-4825/index.md) Cockpit CMS contains an arbitrary file upload vulenrability — cockpit-hq/cockpit < 2.7.0 → 2.7.0
- 2024-05-14 [CVE-2024-34716](https://erroneo.us/security/cve/CVE-2024-34716/index.md) PrestaShop cross-site scripting via customer contact form in FO, through file upload — prestashop/prestashop >= 8.1.0, < 8.1.6 → 8.1.6
- 2024-05-10 [CVE-2024-34070](https://erroneo.us/security/cve/CVE-2024-34070/index.md) Blind XSS Leading to Froxlor Application Compromise — froxlor/froxlor < 2.1.9 → 2.1.9
- 2024-05-03 [CVE-2024-34461](https://erroneo.us/security/cve/CVE-2024-34461/index.md) Zenario uses Twig filters insecurely in the Twig Snippet plugin — tribalsystems/zenario < 9.5.60437 → 9.5.60437
- 2024-04-25 [GHSA-346h-749j-r28w](https://erroneo.us/security/ghsa/GHSA-346h-749j-r28w/index.md) PHPECC vulnerable to multiple cryptographic side-channel attacks — mdanter/ecc >= 0, <= 1.0.0 → no fix
- 2024-04-23 [CVE-2014-8089](https://erroneo.us/security/cve/CVE-2014-8089/index.md) Zend Framework SQL injection vulnerability — zendframework/zendframework1 >= 1.12.0, < 1.12.9 → 1.12.9; zendframework/zend-db >= 2.0.0, < 2.0.99 → 2.0.99; zendframework/zend-db >= 2.1.0, < 2.1.99 → 2.1.99
- 2024-04-23 [CVE-2018-7602](https://erroneo.us/security/cve/CVE-2018-7602/index.md) Drupal Core Remote Code Execution Vulnerability — drupal/core >= 7.0, < 7.59 → 7.59; drupal/core >= 8.0, < 8.4.8 → 8.4.8; drupal/core >= 8.5, < 8.5.3 → 8.5.3
- 2024-04-10 [CVE-2024-31819](https://erroneo.us/security/cve/CVE-2024-31819/index.md) WWBN AVideo Remote Code Execution — wwbn/avideo >= 12.4, <= 14.2 → 14.3
- 2024-04-02 [CVE-2021-27312](https://erroneo.us/security/cve/CVE-2021-27312/index.md) Gleez Cms Server Side Request Forgery (SSRF) vulnerability — gleez/cms <= 1.2.0 → no fix
- 2024-02-22 [GHSA-97m3-52wr-xvv2](https://erroneo.us/security/ghsa/GHSA-97m3-52wr-xvv2/index.md) Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE — phenx/php-svg-lib < 0.5.2 → 0.5.2
- 2024-02-19 [CVE-2024-1651](https://erroneo.us/security/cve/CVE-2024-1651/index.md) Deserialization of Untrusted Data in Torrentpier — torrentpier/torrentpier <= 2.4.1 → no fix
- 2024-02-12 [CVE-2024-25108](https://erroneo.us/security/cve/CVE-2024-25108/index.md) Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions — pixelfed/pixelfed >= 0.10.4, < 0.11.11 → 0.11.11
- 2024-01-17 [CVE-2024-22406](https://erroneo.us/security/cve/CVE-2024-22406/index.md) Blind SQL injection in shopware — shopware/core <= 6.5.7.3 → 6.5.7.4; shopware/platform <= 6.5.7.3 → 6.5.7.4
- 2024-01-11 [CVE-2019-6342](https://erroneo.us/security/cve/CVE-2019-6342/index.md) Drupal Improper Access Control — drupal/core > 8.7.3, < 8.7.5 → 8.7.5; drupal/drupal > 8.7.3, < 8.7.5 → 8.7.5
- 2024-01-10 [CVE-2023-49599](https://erroneo.us/security/cve/CVE-2023-49599/index.md) WWBN AVideo Insufficient Entropy vulnerbaility — wwbn/avideo <= 12.4 → no fix
- 2024-01-02 [CVE-2023-46308](https://erroneo.us/security/cve/CVE-2023-46308/index.md) plotly.js prototype pollution vulnerability — plotly/plotly.js < 2.25.2 → 2.25.2; plotly.js < 2.25.2 → 2.25.2
- 2023-11-30 [CVE-2023-6026](https://erroneo.us/security/cve/CVE-2023-6026/index.md) PHPMemcachedAdmin Path Traversal vulnerability — elijaa/phpmemcacheadmin <= 1.3.0 → no fix
- 2023-11-29 [CVE-2023-44382](https://erroneo.us/security/cve/CVE-2023-44382/index.md) October CMS safe mode bypass using Twig sandbox escape — october/system >= 3.0.0, < 3.4.15 → 3.4.15
- 2023-11-09 [CVE-2023-6069](https://erroneo.us/security/cve/CVE-2023-6069/index.md) Froxlor Improper Input Validation vulnerability — froxlor/froxlor < 2.1.0-beta1 → 2.1.0-beta1
- 2023-11-03 [GHSA-v6xp-ccvx-w52m](https://erroneo.us/security/ghsa/GHSA-v6xp-ccvx-w52m/index.md) Json response for search reveals Solr credentials — ibexa/solr >= 4.5.0, < 4.5.4 → 4.5.4
- 2023-11-03 [GHSA-7crc-r3wg-cfgf](https://erroneo.us/security/ghsa/GHSA-7crc-r3wg-cfgf/index.md) Json response for search reveals Solr credentials — ezsystems/ezplatform-solr-search-engine >= 3.3.0, < 3.3.15 → 3.3.15; ezsystems/ezplatform-solr-search-engine >= 2.0.0, < 2.0.2 → 2.0.2; ezsystems/ezplatform-solr-search-engine >= 1.7.0, < 1.7.12 → 1.7.12
- 2023-10-16 [CVE-2023-43661](https://erroneo.us/security/cve/CVE-2023-43661/index.md) Cachet vulnerable to Authenticated Remote Code Execution — cachethq/cachet < 2.4 → 2.4

Pages: https://erroneo.us/security/ecosystem/composer/index.md · https://erroneo.us/security/ecosystem/composer/2/index.md · https://erroneo.us/security/ecosystem/composer/3/index.md

---
Source page: https://erroneo.us/security/ecosystem/composer/3/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt