---
title: "Critical Composer (PHP) advisories"
url: https://erroneo.us/security/ecosystem/composer/
description: "All 244 critical GitHub-reviewed Composer (PHP) security advisories since October 2023, newest first, with vulnerable ranges and fixed versions."
type: ecosystem
section: "Security Digest"
date_modified: 2026-10-09
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Composer (PHP) advisories

- 2026-10-09 [CVE-2026-107845](https://erroneo.us/security/cve/CVE-2026-107845/index.md) Contao: Cross-site scripting in the comments bundle — contao/comments-bundle >= 4.0.0, < 5.3.50 → 5.3.50; contao/comments-bundle >= 5.4.0-RC1, < 5.7.12 → 5.7.12
- 2026-09-25 [CVE-2026-92161](https://erroneo.us/security/cve/CVE-2026-92161/index.md) FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider — fof/oauth < 1.7.4 → 1.7.4; fof/oauth >= 2.0.0-beta.1, < 2.0.0-beta.4 → 2.0.0-beta.4
- 2026-09-17 [CVE-2026-79752](https://erroneo.us/security/cve/CVE-2026-79752/index.md) CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection — cakephp/database >= 4.6.0, < 4.6.5 → 4.6.5; cakephp/database >= 5.0.0, < 5.1.9 → 5.1.9; cakephp/database >= 5.2.0, < 5.2.14 → 5.2.14
- 2026-09-17 [CVE-2026-75828](https://erroneo.us/security/cve/CVE-2026-75828/index.md) Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS — getgrav/grav <= 2.0.14 → 2.0.15
- 2026-09-17 [CVE-2026-45140](https://erroneo.us/security/cve/CVE-2026-45140/index.md) Chamilo LMS CStudio upload flow allows unauthenticated remote code execution — chamilo/chamilo-lms <= 2.0.0 → 2.0.1
- 2026-09-17 [CVE-2026-75827](https://erroneo.us/security/cve/CVE-2026-75827/index.md) Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write — getgrav/grav <= 2.0.14 → 2.0.15
- 2026-09-08 [CVE-2026-84372](https://erroneo.us/security/cve/CVE-2026-84372/index.md) Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections — predis/predis >= 3.0.0-RC1, < 3.3.0 → 3.3.0
- 2026-09-08 [CVE-2026-77635](https://erroneo.us/security/cve/CVE-2026-77635/index.md) CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver — cakephp/cakephp >= 5.3.0, < 5.3.7 → 5.3.7; cakephp/cakephp >= 5.2.0, < 5.2.15 → 5.2.15; cakephp/cakephp >= 5.1.0, < 5.1.10 → 5.1.10
- 2026-08-28 [CVE-2026-55220](https://erroneo.us/security/cve/CVE-2026-55220/index.md) Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) — pimcore/pimcore >= 2026.1.0, <= 2026.1.5 → 2026.1.6; pimcore/pimcore <= 12.3.9 → 12.3.10
- 2026-08-28 [CVE-2026-55634](https://erroneo.us/security/cve/CVE-2026-55634/index.md) Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name — pimcore/pimcore <= 12.3.9 → 12.3.10; pimcore/pimcore >= 2026.1.0, <= 2026.1.5 → 2026.1.6
- 2026-08-21 [CVE-2026-59989](https://erroneo.us/security/cve/CVE-2026-59989/index.md) Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE) — phalcon/cphalcon <= 5.15.0 → 5.16.0
- 2026-08-18 [CVE-2026-54133](https://erroneo.us/security/cve/CVE-2026-54133/index.md) jmespath.php has CompilerRuntime code injection via unescaped function names — mtdowling/jmespath.php < 2.9.1 → 2.9.1
- 2026-08-18 [CVE-2026-62988](https://erroneo.us/security/cve/CVE-2026-62988/index.md) Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints — froxlor/froxlor < 2.3.8 → 2.3.8
- 2026-08-07 [GHSA-wg23-69c2-gjc8](https://erroneo.us/security/ghsa/GHSA-wg23-69c2-gjc8/index.md) Craft CMS: Passkey login accepts replayed WebAuthn assertions — craftcms/cms >= 5.0.0-RC1, < 5.10.5 → 5.10.5
- 2026-08-07 [CVE-2026-63223](https://erroneo.us/security/cve/CVE-2026-63223/index.md) CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules — codeigniter4/framework < 4.7.4 → 4.7.4
- 2026-08-07 [CVE-2026-63221](https://erroneo.us/security/cve/CVE-2026-63221/index.md) CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions — codeigniter4/framework >= 4.3.0, < 4.7.4 → 4.7.4
- 2026-07-28 [CVE-2026-54588](https://erroneo.us/security/cve/CVE-2026-54588/index.md) Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. — poweradmin/poweradmin < 4.2.4 → 4.2.4; poweradmin/poweradmin >= 4.3.0, < 4.3.3 → 4.3.3
- 2026-07-24 [GHSA-f25v-x6vr-962g](https://erroneo.us/security/ghsa/GHSA-f25v-x6vr-962g/index.md) Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password — pheditor/pheditor < 2.0.8 → 2.0.8
- 2026-07-16 [CVE-2026-55579](https://erroneo.us/security/cve/CVE-2026-55579/index.md) Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise — pheditor/pheditor >= 2.0.1, < 2.0.6 → 2.0.6
- 2026-07-15 [CVE-2026-52881](https://erroneo.us/security/cve/CVE-2026-52881/index.md) MantisBT: Reflected XSS in admin/install.php via unescaped printf — mantisbt/mantisbt <= 2.28.3 → 2.28.4
- 2026-07-15 [CVE-2026-47156](https://erroneo.us/security/cve/CVE-2026-47156/index.md) MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator — mantisbt/mantisbt <= 2.28.3 → 2.28.4
- 2026-07-15 [CVE-2026-52847](https://erroneo.us/security/cve/CVE-2026-52847/index.md) MantisBT: Reflected XSS in admin/install.php — mantisbt/mantisbt <= 2.28.3 → 2.28.4
- 2026-07-14 [GHSA-hgjx-r89m-m7v4](https://erroneo.us/security/ghsa/GHSA-hgjx-r89m-m7v4/index.md) FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to   RCE — facturascripts/facturascripts >= 2025, <= 2026.2 → no fix
- 2026-07-14 [CVE-2026-45262](https://erroneo.us/security/cve/CVE-2026-45262/index.md) FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn` — facturascripts/facturascripts <= 2026.1 → no fix
- 2026-07-13 [CVE-2026-52824](https://erroneo.us/security/cve/CVE-2026-52824/index.md) Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover — kimai/kimai <= 2.57.0 → 2.58.0
- 2026-07-13 [CVE-2026-47677](https://erroneo.us/security/cve/CVE-2026-47677/index.md) FacturaScripts: Account takeover of any 2FA-enabled user — facturascripts/facturascripts <= 2026.2 → 2026.3
- 2026-07-10 [CVE-2026-54159](https://erroneo.us/security/cve/CVE-2026-54159/index.md) prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE — prestashop/ps_facetedsearch >= 3.0.0, < 4.0.4 → 4.0.4
- 2026-07-09 [CVE-2026-52778](https://erroneo.us/security/cve/CVE-2026-52778/index.md) YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service — yeswiki/yeswiki < 4.6.6 → 4.6.6
- 2026-07-09 [CVE-2026-52777](https://erroneo.us/security/cve/CVE-2026-52777/index.md) YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize — yeswiki/yeswiki < 4.6.6 → 4.6.6
- 2026-07-09 [CVE-2026-52766](https://erroneo.us/security/cve/CVE-2026-52766/index.md) YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action — yeswiki/yeswiki < 4.6.6 → 4.6.6
- 2026-07-07 [CVE-2026-27823](https://erroneo.us/security/cve/CVE-2026-27823/index.md) EGroupware has a Remote Code Execution Vulnerability — egroupware/egroupware >= 26.0.20251208, < 26.2.20260224 → 26.2.20260224; egroupware/egroupware < 23.1.20260224 → 23.1.20260224
- 2026-07-06 [CVE-2026-52889](https://erroneo.us/security/cve/CVE-2026-52889/index.md) Formie Hidden field defaults vulnerable to Server-Side Template Injection — verbb/formie < 3.1.27 → 3.1.27
- 2026-07-02 [CVE-2026-9558](https://erroneo.us/security/cve/CVE-2026-9558/index.md) Mautic has Server-Side Template Injection (SSTI) in Theme Templates — mautic/core >= 1.3.0, < 4.4.13 → no fix; mautic/core >= 5.0.0, < 5.2.11 → 5.2.11; mautic/core >= 6.0.0, < 6.0.9 → 6.0.9
- 2026-07-02 [CVE-2026-9559](https://erroneo.us/security/cve/CVE-2026-9559/index.md) Mautic vulnerable to Path Traversal via Campaign Import — mautic/core >= 7.0.0, < 7.1.2 → 7.1.2
- 2026-06-22 [CVE-2025-58048](https://erroneo.us/security/cve/CVE-2025-58048/index.md) Paymenter vulnerable to Remote Code Execution via public file uploads — paymenter/paymenter < 1.2.11 → 1.2.11
- 2026-06-19 [CVE-2026-55791](https://erroneo.us/security/cve/CVE-2026-55791/index.md) Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs — craftcms/cms >= 5.0.0-RC1, < 5.10 → 5.10; craftcms/cms >= 4.0.0-RC1, < 4.18 → 4.18
- 2026-06-18 [CVE-2026-54003](https://erroneo.us/security/cve/CVE-2026-54003/index.md) Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header — getkirby/cms <= 4.9.3 → 4.9.4; getkirby/cms >= 5.0.0-alpha.1, <= 5.4.3 → 5.4.4
- 2026-06-18 [CVE-2026-55742](https://erroneo.us/security/cve/CVE-2026-55742/index.md) Cotonti: Cross-Site Request Forgery in the administration rights handler — cotonti/cotonti <= 1.0.0 → no fix
- 2026-06-15 [CVE-2026-50887](https://erroneo.us/security/cve/CVE-2026-50887/index.md) shlink has a Server-Side Request Forgery issue — shlinkio/shlink <= 5.0.1 → no fix
- 2026-06-15 [CVE-2026-50886](https://erroneo.us/security/cve/CVE-2026-50886/index.md) Project Firefly III has incorrect access control in the webhook management component — grumpydictator/firefly-iii <= 6.5.9 → no fix
- 2026-06-11 [CVE-2026-48062](https://erroneo.us/security/cve/CVE-2026-48062/index.md) CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule — codeigniter4/framework < 4.7.2 → 4.7.3
- 2026-06-09 [CVE-2026-48030](https://erroneo.us/security/cve/CVE-2026-48030/index.md) Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter — pheditor/pheditor >= 2.0.1, <= 2.0.3 → 2.0.4
- 2026-06-08 [CVE-2026-45034](https://erroneo.us/security/cve/CVE-2026-45034/index.md) PHPSpreadsheet has a patch bypass for CVE-2026-34084 — phpoffice/phpspreadsheet <= 1.30.4 → 1.30.5
- 2026-06-05 [CVE-2026-47744](https://erroneo.us/security/cve/CVE-2026-47744/index.md) Shopper: Authorization bypass and RBAC privilege escalation in team settings — shopper/framework < 2.8.0 → 2.8.0
- 2026-06-04 [CVE-2026-54458](https://erroneo.us/security/cve/CVE-2026-54458/index.md) WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin — WWBN/AVideo <= 29.0 → no fix
- 2026-05-26 [CVE-2018-25357](https://erroneo.us/security/cve/CVE-2018-25357/index.md) Dolibarr ERP CRM contains a remote code evaluation vulnerability — dolibarr/dolibarr >= 7.0.0, <= 7.0.3 → 7.0.4; dolibarr/dolibarr < 6.0.8 → 6.0.8
- 2026-05-22 [CVE-2026-46670](https://erroneo.us/security/cve/CVE-2026-46670/index.md) YesWiki: Unauthenticated SQL Injection — yeswiki/yeswiki < 4.6.4 → 4.6.4
- 2026-05-21 [CVE-2026-46633](https://erroneo.us/security/cve/CVE-2026-46633/index.md) Twig: PHP code injection via `{% use %}` template name — twig/twig < 3.26.0 → 3.26.0
- 2026-05-21 [CVE-2026-8134](https://erroneo.us/security/cve/CVE-2026-8134/index.md) Concrete CMS Vulnerable to Relative Path Traversal — concrete5/concrete5 < 9.5.1 → 9.5.1
- 2026-05-20 [CVE-2026-9082](https://erroneo.us/security/cve/CVE-2026-9082/index.md) Drupal Core has a SQL Injection issue — drupal/core >= 8.9.0, < 10.4.10 → 10.4.10; drupal/core >= 10.5.0, < 10.5.10 → 10.5.10; drupal/core >= 10.6.0, < 10.6.9 → 10.6.9
- 2026-05-19 [CVE-2026-46725](https://erroneo.us/security/cve/CVE-2026-46725/index.md) TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector) — mmc/ceselector >= 6.0.0, < 6.0.1 → 6.0.1; mmc/ceselector >= 5.0.0, < 5.0.1 → 5.0.1; mmc/ceselector >= 4.0.0, < 4.0.2 → 4.0.2
- 2026-05-18 [CVE-2026-45697](https://erroneo.us/security/cve/CVE-2026-45697/index.md) Formie: Pre-authenticated server-side template injection in Hidden fields — verbb/formie >= 3.0.0-beta.1, < 3.1.24 → 3.1.24; verbb/formie < 2.2.20 → 2.2.20
- 2026-05-11 [GHSA-h29g-c9cx-c73q](https://erroneo.us/security/ghsa/GHSA-h29g-c9cx-c73q/index.md) torrentpier has PHP Serialize Injections — torrentpier/torrentpier <= 2.4.3 → 2.4.4
- 2026-05-08 [CVE-2026-37709](https://erroneo.us/security/cve/CVE-2026-37709/index.md) Snipe-IT has insecure permissions in file uploads — snipe/snipe-it < 8.4.1 → 8.4.1
- 2026-05-08 [CVE-2026-44212](https://erroneo.us/security/cve/CVE-2026-44212/index.md) PrestaShop has a stored XSS executable in customer service view — prestashop/prestashop < 8.2.6 → 8.2.6; prestashop/prestashop >= 9.0.0, < 9.1.1 → 9.1.1
- 2026-05-07 [GHSA-gr3r-crp5-qrrm](https://erroneo.us/security/ghsa/GHSA-gr3r-crp5-qrrm/index.md) Compromised tag of intercom-php published via GitHub — intercom/intercom-php = 5.0.2 → no fix
- 2026-05-06 [CVE-2026-45010](https://erroneo.us/security/cve/CVE-2026-45010/index.md) phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id — thorsten/phpmyfaq <= 4.1.1 → 4.1.2; phpmyfaq/phpmyfaq <= 4.1.1 → 4.1.2
- 2026-05-06 [CVE-2026-44262](https://erroneo.us/security/cve/CVE-2026-44262/index.md) Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules — dedoc/scramble >= 0.13.2, <= 0.13.21 → 0.13.22
- 2026-05-06 [CVE-2026-46364](https://erroneo.us/security/cve/CVE-2026-46364/index.md) phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha — thorsten/phpmyfaq <= 4.1.1 → 4.1.2; phpmyfaq/phpmyfaq <= 4.1.1 → 4.1.2
- 2026-05-05 [CVE-2026-42607](https://erroneo.us/security/cve/CVE-2026-42607/index.md) Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature — getgrav/grav < 2.0.0-beta.2 → 2.0.0-beta.2
- 2026-05-05 [GHSA-vj3m-2g9h-vm4p](https://erroneo.us/security/ghsa/GHSA-vj3m-2g9h-vm4p/index.md) Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass — getgrav/grav < 2.0.0-beta.2 → 2.0.0-beta.2
- 2026-05-05 [CVE-2026-42613](https://erroneo.us/security/cve/CVE-2026-42613/index.md) Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access — getgrav/grav < 2.0.0-beta.2 → 2.0.0-beta.2
- 2026-05-05 [CVE-2026-42155](https://erroneo.us/security/cve/CVE-2026-42155/index.md) Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs — openmage/magento-lts <= 20.17.0 → 20.18.0
- 2026-05-04 [CVE-2026-42569](https://erroneo.us/security/cve/CVE-2026-42569/index.md) phpVMS has an /importer authorization bypass causing full database wipe — nabeel/phpvms < 7.0.6 → 7.0.6
- 2026-04-29 [CVE-2026-34084](https://erroneo.us/security/cve/CVE-2026-34084/index.md) PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled — phpoffice/phpspreadsheet >= 4.0.0, <= 5.5.0 → 5.6.0; phpoffice/phpspreadsheet >= 3.3.0, <= 3.10.3 → 3.10.4; phpoffice/phpspreadsheet >= 2.2.0, <= 2.4.3 → 2.4.4
- 2026-04-29 [CVE-2026-38992](https://erroneo.us/security/cve/CVE-2026-38992/index.md) Cockpit is vulnerable to arbitrary code execution — cockpit-hq/cockpit < 2.14.0 → 2.14.0
- 2026-04-22 [CVE-2026-41203](https://erroneo.us/security/cve/CVE-2026-41203/index.md) CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE — ci4-cms-erp/ci4ms < 0.31.5.0 → 0.31.5.0
- 2026-04-22 [CVE-2026-41202](https://erroneo.us/security/cve/CVE-2026-41202/index.md) CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE — ci4-cms-erp/ci4ms < 0.31.5.0 → 0.31.5.0
- 2026-04-17 [CVE-2026-23500](https://erroneo.us/security/cve/CVE-2026-23500/index.md) Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration — dolibarr/dolibarr <= 22.0.4 → no fix
- 2026-04-16 [CVE-2026-31843](https://erroneo.us/security/cve/CVE-2026-31843/index.md) goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files — goodoneuz/pay-uz <= 2.2.24 → 3.0.0
- 2026-04-15 [CVE-2026-41228](https://erroneo.us/security/cve/CVE-2026-41228/index.md) Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution — froxlor/froxlor <= 2.3.5 → 2.3.6
- 2026-04-15 [CVE-2026-41229](https://erroneo.us/security/cve/CVE-2026-41229/index.md) Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) — froxlor/froxlor <= 2.3.5 → 2.3.6
- 2026-04-14 [CVE-2026-40911](https://erroneo.us/security/cve/CVE-2026-40911/index.md) WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks — wwbn/avideo <= 29.0 → no fix
- 2026-04-06 [CVE-2026-35035](https://erroneo.us/security/cve/CVE-2026-35035/index.md) CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.31.1.0 → 0.31.2.0
- 2026-04-02 [CVE-2026-34989](https://erroneo.us/security/cve/CVE-2026-34989/index.md) CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 31.0.0.0
- 2026-04-01 [CVE-2026-34565](https://erroneo.us/security/cve/CVE-2026-34565/index.md) CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-04-01 [CVE-2026-34568](https://erroneo.us/security/cve/CVE-2026-34568/index.md) CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-04-01 [CVE-2026-34560](https://erroneo.us/security/cve/CVE-2026-34560/index.md) CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-04-01 [CVE-2026-34567](https://erroneo.us/security/cve/CVE-2026-34567/index.md) CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-04-01 [CVE-2026-34561](https://erroneo.us/security/cve/CVE-2026-34561/index.md) CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-04-01 [CVE-2026-34564](https://erroneo.us/security/cve/CVE-2026-34564/index.md) CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-04-01 [CVE-2026-34569](https://erroneo.us/security/cve/CVE-2026-34569/index.md) CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-04-01 [CVE-2026-34571](https://erroneo.us/security/cve/CVE-2026-34571/index.md) CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-04-01 [CVE-2026-34563](https://erroneo.us/security/cve/CVE-2026-34563/index.md) CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-04-01 [CVE-2026-34566](https://erroneo.us/security/cve/CVE-2026-34566/index.md) CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-04-01 [CVE-2026-34559](https://erroneo.us/security/cve/CVE-2026-34559/index.md) CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-03-31 [CVE-2026-34558](https://erroneo.us/security/cve/CVE-2026-34558/index.md) CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-03-31 [CVE-2026-34557](https://erroneo.us/security/cve/CVE-2026-34557/index.md) CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-03-31 [CVE-2026-21861](https://erroneo.us/security/cve/CVE-2026-21861/index.md) baserCMS has OS Command Injection Leading to Remote Code Execution (RCE) — baserproject/basercms <= 5.2.2 → 5.2.3
- 2026-03-31 [CVE-2026-30877](https://erroneo.us/security/cve/CVE-2026-30877/index.md) baserCMS Update Functionality Vulnerable to OS Command Injection — baserproject/basercms <= 5.2.2 → 5.2.3
- 2026-03-31 [CVE-2026-30880](https://erroneo.us/security/cve/CVE-2026-30880/index.md) baserCMS has OS command injection vulnerability in installer — baserproject/basercms <= 5.2.2 → 5.2.3
- 2026-03-30 [CVE-2026-27599](https://erroneo.us/security/cve/CVE-2026-27599/index.md) ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS — ci4-cms-erp/ci4ms <= 0.28.6.0 → 0.31.0.0
- 2026-03-26 [CVE-2026-33867](https://erroneo.us/security/cve/CVE-2026-33867/index.md) AVideo has Plaintext Video Password Storage — wwbn/avideo <= 26.0 → no fix
- 2026-03-25 [CVE-2026-33716](https://erroneo.us/security/cve/CVE-2026-33716/index.md) AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php — wwbn/avideo <= 26.0 → no fix
- 2026-03-23 [CVE-2026-30849](https://erroneo.us/security/cve/CVE-2026-30849/index.md) MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL — mantisbt/mantisbt < 2.28.1 → 2.28.1
- 2026-03-20 [CVE-2026-33478](https://erroneo.us/security/cve/CVE-2026-33478/index.md) AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection — wwbn/avideo <= 26.0 → no fix
- 2026-03-20 [CVE-2026-33502](https://erroneo.us/security/cve/CVE-2026-33502/index.md) AVideo has Unauthenticated SSRF via plugin/Live/test.php — wwbn/avideo <= 26.0 → no fix
- 2026-03-19 [CVE-2026-33352](https://erroneo.us/security/cve/CVE-2026-33352/index.md) AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) — wwbn/avideo <= 26.0 → no fix
- 2026-03-19 [CVE-2026-33351](https://erroneo.us/security/cve/CVE-2026-33351/index.md) AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass — wwbn/avideo <= 26.0 → no fix
- 2026-03-16 [CVE-2026-32817](https://erroneo.us/security/cve/CVE-2026-32817/index.md) Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion — admidio/admidio >= 5.0.0, <= 5.0.6 → 5.0.7

Pages: https://erroneo.us/security/ecosystem/composer/index.md · https://erroneo.us/security/ecosystem/composer/2/index.md · https://erroneo.us/security/ecosystem/composer/3/index.md

---
Source page: https://erroneo.us/security/ecosystem/composer/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt