Low3.5CVE-2026-45710
FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`
facturascripts/facturascripts
- Affected
- <=2026.1
- Fixed in
- 2026.2
Security advisories
Advisories affecting Composer packages, taken from public advisory databases. Each entry lists the affected version ranges and fixed versions exactly as published, and links to the original source.
- Low3.1CVE-2026-52841
Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync
alextselegidis/easyappointments
- Affected
- <=1.5.2
- Fixed in
- 1.6.1
- Low2.6CVE-2026-52838
Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
alextselegidis/easyappointments
- Affected
- <=1.5.2
- Fixed in
- 1.6.1
- Low2.7CVE-2026-52840
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
alextselegidis/easyappointments
- Affected
- <=1.5.2
- Fixed in
- 1.6.1
- Low2.0CVE-2026-125341
Winter: Stored XSS through Backend List widget image columns
winter/wn-backend-module
- Affected
- >=1.1.0, <1.2.14
- Fixed in
- 1.2.14
- Low3.1CVE-2026-102279
Laravel: XSS in Debug Page Information
laravel/framework
- Affected
- <12.69.0>=13.0.0, <13.30.0
- Fixed in
- 12.69.013.30.0
- Low2.3CVE-2026-128083
Laravel: Task Output Injection - Concurrency Process
laravel/framework
- Affected
- <12.71.0>=13.0.0, <13.40.0
- Fixed in
- 12.71.013.40.0