porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Composer and PHP security advisories.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

6 NOV 2024

LOW2.2
twig/twig composer

Unguarded calls to __isset() and to array-accesses when the sandbox is enabled

fixed in 3.11.2 · 3.14.1

LOW2.2
twig/twig composer

Unguarded calls to __toString() when nesting an object into an array

fixed in 3.11.2 · 3.14.1

5 NOV 2024

HIGH0.0
symfony/process composer

CVE-2024-51736: Command execution hijack on Windows with Process class

fixed in 5.4.46 · 6.4.14 · 7.1.7

LOW3.1
symfony/http-foundation composer

CVE-2024-50345: Open redirect via browser-sanitized URLs

fixed in 5.4.46 · 6.4.14 · 7.1.7

8 OCT 2024

HIGH7.5
livewire/livewire composer

Livewire Remote Code Execution on File Uploads

fixed in 2.12.7 · 3.5.2

7 OCT 2024

HIGH7.5
phpoffice/phpspreadsheet composer

XXE in PHPSpreadsheet's XLSX reader

fixed in 1.29.1 · 2.1.1 · 2.3.0

MODERATE5.4
phpoffice/phpspreadsheet composer

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

fixed in 1.29.2 · 2.1.1 · 2.3.0

MODERATE6.3
phpoffice/phpspreadsheet composer

PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled

fixed in 1.29.2 · 2.1.1 · 2.3.0

HIGH7.7
phpoffice/phpspreadsheet composer

PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file

fixed in 1.29.2 · 2.1.1 · 2.3.0

MODERATE6.1
phpoffice/phpspreadsheet composer

PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file

fixed in 1.29.2 · 2.1.1 · 2.3.0

9 SEP 2024

MODERATE5.5
craftcms/cms composer

Craft CMS vulnerable to stored XSS in breadcrumb list and title fields

fixed in 5.1.2

MODERATE8.5
twig/twig composer

Possible sandbox bypass

fixed in 1.44.7 · 2.16.0 · 3.11.0 · 3.14.0

29 AUG 2024

HIGH8.8
phpoffice/phpspreadsheet composer

XXE in PHPSpreadsheet encoding is returned

fixed in 1.29.1 · 2.1.1 · 2.2.1

MODERATE5.4
phpoffice/phpspreadsheet composer

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

fixed in 1.29.1 · 2.1.0

25 JUL 2024

MODERATE4.8
craftcms/cms composer

Craft CMS Allows TOTP Token To Stay Valid After Use

no fix yet

15 JUL 2024

MODERATE5.3
web-auth/webauthn-lib composer

The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames

fixed in 4.9.0

25 JUN 2024

CRITICAL9.8
craftcms/cms composer

Craft CMS SQL injection vulnerability via the GraphQL API endpoint

no fix yet

4 JUN 2024

HIGH8.1
yiisoft/yii2 composer

Unsafe Reflection in base Component class

fixed in 2.0.49.4

2 JUN 2024

LOW1.8
statamic/cms composer

Password confirmation stored in plain text via registration form in statamic/cms

fixed in 5.6.2

MODERATE4.2
yiisoft/yii2 composer

Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

fixed in 2.0.49.4

20 MAY 2024

MODERATE4.4
verbb/formie composer

verbb/formie Server-Side Template Injection for variable-enabled settings

fixed in 2.1.6

15 MAY 2024

MODERATE
laravel/framework composer

Laravel Hijacked authentication cookies vulnerability

fixed in 4.1.26

MODERATE
laravel/framework composer

Laravel Risk of mass-assignment vulnerabilities

fixed in 4.1.29

MODERATE4.0
amphp/http-client composer

amphp/http-client Header leakage on cross-domain redirects

fixed in 4.4.0

19 MAR 2024

MODERATE6.1
livewire/livewire composer

Cross-site Scripting in livewire/livewire

fixed in 3.4.9

22 FEB 2024

CRITICAL10.0
phenx/php-svg-lib composer

Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

fixed in 0.5.2

21 FEB 2024

MODERATE6.8
phenx/php-svg-lib composer

php-svg-lib lacks path validation on font through SVG inline styles

fixed in 0.5.2

1 FEB 2024

HIGH8.2
statamic/cms composer

Statmic CMS vulnerable to account takeover via XSS and password reset link

fixed in 3.4.17 · 4.46.0

30 JAN 2024

HIGH7.5
craftcms/cms composer

Craft CMS Feed-Me

fixed in 4.6.2

3 JAN 2024

MODERATE5.4
craftcms/cms composer

Craft CMS Privilege Escalation

no fix yet

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →