Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS20 JUN 2023
26 MAY 2023
22 MAY 2023
Craft CMS vulnerable to Remote Code Execution via unrestricted file extension
fixed in 4.4.6
12 MAY 2023
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
no fix yet
5 MAY 2023
craftcms/cms vulnerable to cross site scripting in RSS feed widget
no fix yet
25 APR 2023
17 APR 2023
3 MAR 2023
Craft CMS Stored Cross-site Scripting Injection Vulnerability
fixed in 3.7.64 · 4.3.7
7 FEB 2023
URI validation failure on SVG parsing. Bypass of CVE-2023-23924
no fix yet
1 FEB 2023
CVE-2022-24894: Prevent storing cookie headers in HttpCache
fixed in 4.4.50 · 5.4.20 · 6.0.20 · 6.1.12 · 6.2.6
31 JAN 2023
Dompdf vulnerable to URI validation failure on SVG parsing
fixed in 2.0.2
5 DEC 2022
25 NOV 2022
Browsershot vulnerable to Cross-Site Scripting (XSS)
fixed in 3.57.3
Browsershot does not validate URL protocols passed to Browsershot URL method
fixed in 3.57.3
Browsershot version 3.57.3 vulnerable to improper input validation
fixed in 3.57.4
28 SEP 2022
Possibility to load a template outside a configured directory when using the filesystem loader
fixed in 1.44.7 · 2.15.3 · 3.4.3
22 SEP 2022
Craft CMS Cross-site Scripting vulnerability
fixed in 3.7.51 · 4.2.1
17 SEP 2022
Craft CMS Stored Cross-site Scripting in User Addresses Title
fixed in 4.2.1
Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts
fixed in 3.7.55.2 · 4.2.1
Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page
fixed in 4.2.1
19 JUL 2022
Dompdf before v2.0.0 vulnerable to chroot check bypass
fixed in 2.0.0
23 JUN 2022
20 JUN 2022
CURLOPT_HTTPAUTH option not cleared on change of origin
fixed in 6.5.8 · 7.4.5
Change in port should be considered a change in origin
fixed in 6.5.8 · 7.4.5
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.