Security advisories

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

• adminneo-org/adminneo

  Affected

  <5.5.1

  Fixed in

  5.5.1

Original advisory (GitHub Advisory Database)

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

• adminneo-org/adminneo

  Affected

  >=4.6.0, <5.5.1

  Fixed in

  5.5.1

Original advisory (GitHub Advisory Database)

AdminNeo SQLite Database-List Drop Arbitrary File Deletion

• adminneo-org/adminneo

  Affected

  <5.5.1

  Fixed in

  5.5.1

Original advisory (GitHub Advisory Database)

AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

• adminneo-org/adminneo

  Affected

  <5.5.1

  Fixed in

  5.5.1

Original advisory (GitHub Advisory Database)

PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

• phpunit/phpunit

  Affected

  >=13.4.0, <13.4.4

  Fixed in

  13.4.4

Original advisory (GitHub Advisory Database)

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

• facturascripts/facturascripts

  Affected

  <=2026.1

  Fixed in

  2026.2

Original advisory (GitHub Advisory Database)

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

• facturascripts/facturascripts

  Affected

  <=2026.1

  Fixed in

  2026.2

Original advisory (GitHub Advisory Database)

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

• facturascripts/facturascripts

  Affected

  >=2025, <=2026.2

  Fixed in

  2026.3

Original advisory (GitHub Advisory Database)

Composer has a command injection via malicious perforce repository

• composer/composer

  Affected

  >=2.3.0, <2.9.6>=1.0.0, <2.2.27

  Fixed in

  2.2.272.9.6

Original advisory (GitHub Advisory Database)

Filament: Disabled RichEditor field state can be used for XSS

In Filament v3, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. Please note tha…

• filament/forms

  Affected

  >=3.0.0, <=3.3.52

  Fixed in

  3.3.53

Original advisory (GitHub Advisory Database)

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

• silverstripe/mfa

  Affected

  <6.0.0

  Fixed in

  6.0.0

Original advisory (GitHub Advisory Database)

Twig: PHP code injection via `{% use %}` template name

• twig/twig

  Affected

  >=1.15.1, <3.26.0

  Fixed in

  3.26.0

Original advisory (GitHub Advisory Database)

Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter

• dolibarr/dolibarr

  Affected

  <22.0.5>=23.0.0, <23.0.2

  Fixed in

  22.0.523.0.2

Original advisory (GitHub Advisory Database)

FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

• facturascripts/facturascripts

  Affected

  <=2026.1

  Fixed in

  2026.2

Original advisory (GitHub Advisory Database)

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

• mongodb/mongodb

  Affected

  >=1.1.0, <1.21.5>=2.0.0, <2.4.2

  Fixed in

  1.21.52.4.2

Original advisory (GitHub Advisory Database)

FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

• filegator/filegator

  Affected

  <=7.14.4

  Fixed in

  7.15.0

Original advisory (GitHub Advisory Database)

FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

• filegator/filegator

  Affected

  <=7.14.4

  Fixed in

  7.15.0

Original advisory (GitHub Advisory Database)

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

• alextselegidis/easyappointments

  Affected

  <=1.5.2

  Fixed in

  1.6.1

Original advisory (GitHub Advisory Database)

Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

• alextselegidis/easyappointments

  Affected

  <=1.5.2

  Fixed in

  1.6.1

Original advisory (GitHub Advisory Database)

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

• alextselegidis/easyappointments

  Affected

  <=1.5.2

  Fixed in

  1.6.1

Original advisory (GitHub Advisory Database)