payload
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 29 advisory(ies) without a verdict
Advisories (29)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-238x-w2j9-gwwr Payload vulnerable to API key disclosure through ordinary document reads | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-26rv-h2hf-3fw4 Payload's SQLite adapter Session Fixation vulnerability | < 3.44.0 | Undetermined |
| GHSA-2g7p-5934-q4w7 Payload: ReDoS in Multipart Content-Type Validation | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-2pwp-2369-8fg3 Payload: Bypassed sanitization of user uploaded SVGs | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-35jj-vqcf-f2jf Hidden fields can be leaked on readable collections in Payload | < 1.7.0 | Undetermined |
| GHSA-5v66-m237-hwf7 Payload does not invalidate JWTs after log out | < 3.44.0 | Undetermined |
| GHSA-66wr-7vmr-p5jq Payload authentication token field handling issue | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-6r7f-q7f5-wpx8 Payload has Authenticated SSRF via Upload Functionality | < 3.79.1 | Undetermined |
| GHSA-7c34-32v3-j575 Payload relationship-query authorization bypass | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-7xxh-373w-35vg Payload has an SQL Injection via Query Handling | < 3.79.1 | Undetermined |
| GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-9g87-32v6-3c2r Payload: Sort queries could expose protected field information | < 3.88.0 ; 4.0.0-canary.0 – < 4.0.0-canary.27 | Undetermined |
| GHSA-9qpg-3cf8-w33x Payload: Uploaded XML files could execute same-origin JavaScript | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-f7hx-52q9-hcrf Payload: Unauthorized update to collection documents | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-fpww-c55p-cjv6 Payload: Polymorphic join queries could disclose hidden fields | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-fx49-4h83-wjv9 Payload didn't enforce field-level password update restrictions | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-hhfx-5x8j-f5f6 Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads | < 3.75.0 | Undetermined |
| GHSA-hp5w-3hxx-vmwf Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery | < 3.79.1 | Undetermined |
| GHSA-jg8r-5jh2-v2xj Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts | ≤ 3.88.0 | Undetermined |
| GHSA-jq29-r496-r955 payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) | < 3.74.0 | Undetermined |
| GHSA-p223-2wr2-j562 Payload: Incomplete validation during the upload file lifecycle | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-p6mr-xf3r-ghq4 Payload has a CSRF Protection Bypass in Authentication Flow | < 3.79.1 | Undetermined |
| GHSA-pj5h-5q6c-3pfx Payload external upload trust validation issue | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-q6mq-ch85-c8mm Payload: Password hashes use insufficient PBKDF2 iterations | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-v49j-62m6-pgrr Payload: SQL Injection in SQLite and Postgres | 3.0.0 – < 3.88.0 ; 4.0.0-canary.0 – < 4.0.0-canary.27 | Undetermined |
| GHSA-v5gf-vpjc-pc7w Payload: Unauthenticated account-lockout denial of service | < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
| GHSA-w84c-53h3-mc2g Payload: Untrusted redirect URL parameter exploit | 3.40.0 – < 3.88.0 ; 4.0.0-canary.0 – < 4.0.0-canary.27 | Undetermined |
| GHSA-w8xh-93qh-35vw Unrestricted Upload of File with Dangerous Type in Payload | < 0.15.1 | Undetermined |
| GHSA-xgv3-crq2-6f69 Payload: Token refresh and password reset responses may expose restricted user fields | 3.0.0 – < 3.90.0 ; 4.0.0-canary.0 – < 4.0.0-canary.34 | Undetermined |
Sources
| Source | Licence |
|---|