Packagist Package Vulnerabilities
Vulnerabilities associated with tcg/voyager.
Packages
Clear package- moodle/moodle437 vulnerabilities
- magento/community-edition362 vulnerabilities
- typo3/cms188 vulnerabilities
- magento/project-community-edition161 vulnerabilities
- wwbn/avideo144 vulnerabilities
- pimcore/pimcore132 vulnerabilities
- craftcms/cms128 vulnerabilities
- typo3/cms-core127 vulnerabilities
- dolibarr/dolibarr126 vulnerabilities
- concrete5/concrete5119 vulnerabilities
- drupal/core109 vulnerabilities
- phpmyadmin/phpmyadmin107 vulnerabilities
- thorsten/phpmyfaq106 vulnerabilities
- microweber/microweber105 vulnerabilities
- librenms/librenms101 vulnerabilities
- symfony/symfony100 vulnerabilities
- silverstripe/framework90 vulnerabilities
- drupal/drupal81 vulnerabilities
- mantisbt/mantisbt74 vulnerabilities
- shopware/platform74 vulnerabilities
- getgrav/grav69 vulnerabilities
- shopware/core65 vulnerabilities
- snipe/snipe-it57 vulnerabilities
- baserproject/basercms56 vulnerabilities
- mautic/core56 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-32931CRITICAL | DevDojo Voyager Argument Injection vulnerabilityDevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command. CWE-88Apr 14, 2025 | CVSS9.1v3.1 | EPSS0.536% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-55417MEDIUM | DevDojo Voyager Arbitrary File WriteDevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server. | CVSS4.3v3.1 | EPSS13.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
DevDojo Voyager vulnerable to reflected Cross-site ScriptingDevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed. | CVSS-v4.0 | EPSS23% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX | |
DevDojo Voyager vulnerable to path traversalDevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass. | CVSS-v4.0 | EPSS15.5% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX | |
CVE-2020-36070CRITICAL | Remote code execution in VoyagerInsecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media component. CWE-281Apr 26, 2023 | CVSS9.8v3.1 | EPSS1.08% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |