Search Vulnerabilities

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf: File existence oracle via font-face stylesheet declaration

Dompdf: Chroot Validation Bypass

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

Guzzle: URI fragments disclosed in redirect Referer headers

Guzzle: Host-only cookie scope is not preserved

Guzzle: Unbounded response cookies risk denial of service

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files