payload vulnerabilities (npm)
30 vulnerabilities.
-
payloadnpm Payload: Uploaded XML files could execute same-origin JavaScript 8.6 High -
payloadnpm Payload: Unauthenticated account-lockout denial of service 6.9 Medium -
payloadnpm Payload: Incomplete validation during the upload file lifecycle 8.1 High -
payloadnpm Payload authentication token field handling issue 9.2 Critical -
payloadnpm Payload: Bypassed sanitization of user uploaded SVGs 8.7 High -
payloadnpm Payload external upload trust validation issue 7.2 High -
payloadnpm Payload: Unauthorized update to collection documents 9.8 Critical -
payloadnpm Payload: Remote Code Execution through first-register 8.1 High -
payloadnpm Payload: Field-level password update restrictions were not enforced 7.6 High -
payloadnpm Payload: ReDoS in Multipart Content-Type Validation 8.7 High -
payloadnpm Payload: Token refresh and password reset responses may expose restricted user fields 7.1 High -
payloadnpm Payload relationship-query authorization bypass 6.9 Medium -
payloadnpm Payload: Field access control bypass on auth collections 9.3 Critical -
payloadnpm Payload: API key disclosure through ordinary document reads 7.7 High -
payloadnpm Payload: Polymorphic join queries could disclose hidden fields 7.1 High -
payloadnpm Payload: Untrusted redirect URL parameter exploit 6.1 Medium -
payloadnpm Payload: SQL Injection in SQLite and Postgres 9.8 Critical -
payloadnpm Payload: Sort queries could expose protected field information 6.9 Medium -
payloadnpm Payload: Password hashes use insufficient PBKDF2 iterations 5.7 Medium -
payloadnpm PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access 5.3 Medium -
payloadnpm Payload has a CSRF Protection Bypass in Authentication Flow 5.4 Medium -
payloadnpm Payload has an SQL Injection via Query Handling 8.5 High -
payloadnpm Payload has Authenticated SSRF via Upload Functionality 7.7 High -
payloadnpm Payload has Unvalidated Input in Password Recovery Endpoints 9.1 Critical -
payloadnpm Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads 6.5 Medium -
payloadnpm Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) 5.4 Medium -
payloadnpm User Session Fixation after Account Removal in PayloadCMS 5.3 Medium -
payloadnpm Lack of JWT Expiration after Log Out in PayloadCMS 6.3 Medium -
payloadnpm Payload's hidden fields can be leaked on readable collections 7.4 High -
payloadnpm Unrestricted Upload of File with Dangerous Type in Payload 9.8 Critical