VulnerableCode Package Details - pkg:composer/badaso/core@2.2.1

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:composer/badaso/core@2.2.1

Essentials
History (3)

purl	pkg:composer/badaso/core@2.2.1

Next non-vulnerable version	2.9.12
Latest non-vulnerable version	2.9.12
Risk	4.5

Vulnerabilities affecting this package (3)

Vulnerability	Summary	Fixed by
VCID-19n6-8ndj-cbeg Aliases: CVE-2025-52353 GHSA-gqp9-jh35-439m	An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.	2.9.12 Affected by 0 other vulnerabilities.
VCID-aduh-1gve-mfbk Aliases: CVE-2022-41705 GHSA-g389-rf5p-fg56	Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.	2.7.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-zw5m-qryp-97eq Aliases: CVE-2022-41711 GHSA-fwvc-9xhj-26v5	Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.	2.6.1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-12T20:13:10.076595+00:00	GitLab Importer	Affected by	VCID-19n6-8ndj-cbeg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/badaso/core/CVE-2025-52353.yml	38.6.0
2026-06-12T18:40:46.286269+00:00	GitLab Importer	Affected by	VCID-aduh-1gve-mfbk	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/badaso/core/CVE-2022-41705.yml	38.6.0
2026-06-12T18:38:00.923498+00:00	GitLab Importer	Affected by	VCID-zw5m-qryp-97eq	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/badaso/core/CVE-2022-41711.yml	38.6.0