GHSA-9778-v769-qvjf

Suggest an improvement
Source
https://github.com/advisories/GHSA-9778-v769-qvjf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-9778-v769-qvjf/GHSA-9778-v769-qvjf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9778-v769-qvjf
Aliases
Published
2025-10-21T21:33:41Z
Modified
2025-10-21T23:27:51Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
code16 Sharp vulnerable to Cross Site Scripting (XSS)
Details

code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-21T22:22:36Z",
    "nvd_published_at": "2025-10-21T19:21:24Z",
    "severity": "MODERATE"
}
References

Affected packages

Packagist / code16/sharp

Package

Name
code16/sharp
Purl
pkg:composer/code16/sharp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.7.0

Affected versions

v4.*
v4.0-BETA1
v4.0-BETA2
v4.0-BETA3
v4.0-BETA4
v4.0-BETA5
v4.0-BETA6
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.14
v4.0.15
v4.0.16
v4.0.17
v4.0.18
v4.0.19
v4.0.20
v4.0.21
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.1.4
v4.1.5
v4.1.6
v4.1.7
v4.1.8
v4.1.9
v4.1.10
v4.1.11
v4.1.12
v4.1.13
v4.1.14
v4.1.15
v4.1.16
v4.1.17
v4.1.18
v4.1.19
v4.1.20
v4.1.21
v4.1.22
v4.1.23
v4.1.24
v4.1.25
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.2.6
v5.*
v5.0.0-alpha.1
v5.0.0-alpha.2
v5.0.0-alpha.3
v5.0.0-alpha.4
v5.0.0-alpha.5
v5.0.0-alpha.6
v5.0.0-alpha.7
v5.0.0-alpha.8
v5.0.0-alpha.9
v5.0.0-alpha.10
v5.0.0
v5.0.1
v5.1.0
v5.1.1
v5.1.2
v5.2.0
v5.3.0
v5.3.1
v5.3.2
v5.3.3
v5.3.4
v5.3.5
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.4.6
v6.*
v6.0.0-alpha.1
v6.0.0-alpha.2
v6.0.0-alpha.3
v6.0.0-alpha.4
v6.0.0-alpha.5
v6.0.0-alpha.6
v6.0.0-alpha.7
v6.0.0-beta.1
v6.0.0-beta.2
v6.0.0-beta.3
v6.0.0
v6.0.1
v6.1.0
v6.1.1
v6.1.2
v6.1.3
v6.1.4
v6.1.5
v6.2.0
v6.3.0
v6.3.1
v6.3.2
v6.3.3
v6.4.0
v6.4.1
v6.5.0
v6.5.1
v6.5.2
v6.5.3
v6.5.4
v6.5.5
7.*
7.0.0-alpha.1
7.7.2
7.27.0
v7.*
v7.0.0-beta.1
v7.0.0-beta.2
v7.0.0-beta.3
v7.0.0-beta.4
v7.0.0-beta.5
v7.0.0-beta.6
v7.0.0
v7.0.1
v7.0.2
v7.1.0
v7.2.0
v7.2.1
v7.2.2
v7.2.3
v7.2.4
v7.2.5
v7.3.0
v7.4.0
v7.5.0
v7.5.1
v7.5.2
v7.6.0
v7.7.0
v7.7.1
v7.8.0
v7.9.0
v7.10.0
v7.11.0
v7.12.0
v7.13.0
v7.14.0
v7.15.0
v7.16.0
v7.17.0
v7.17.1
v7.17.2
v7.17.3
v7.18.0
v7.19.0
v7.19.1
v7.20.0
v7.21.0
v7.22.0
v7.23.0
v7.23.1
v7.23.2
v7.24.0
v7.24.1
v7.25.0
v7.25.1
v7.25.2
v7.26.0
v7.26.1
v7.26.2
v7.27.1
v7.28.0
v7.29.0
v7.29.1
v7.29.2
v7.29.3
v7.29.4
v7.29.5
v7.29.6
v7.29.7
v7.30.0
v8.*
v8.0.0
v8.0.1
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.0.7
v8.1.0
v8.1.1
v8.1.2
v8.2.0
v8.2.1
v8.3.0
v8.3.1
v8.3.2
v8.3.3
v8.3.4
v8.3.5
v8.3.6
v8.3.7
v8.4.0
v8.4.1
v8.4.2
v8.4.3
v8.4.4
v8.5.0
v8.6.0
v8.6.1
v9.*
v9.0.0-alpha.1
v9.0.0-alpha.2
v9.0.0-beta.1
v9.0.0-beta.2
v9.0.0-beta.3
v9.0.0-beta.4
v9.0.0-beta.5
v9.0.0-beta.6
v9.0.0-beta.7
v9.0.0-beta.8
v9.0.0-beta.9
v9.0.0-beta.10
v9.0.0-beta.11
v9.0.0-beta.12
v9.0.0-beta.13
v9.0.0-beta.14
v9.0.0-beta.15
v9.0.0-beta.16
v9.0.0-beta.17
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.0.4
v9.0.5
v9.0.6
v9.0.7
v9.0.8
v9.0.9
v9.1.0
v9.1.1
v9.1.2
v9.2.0
v9.2.1
v9.2.2
v9.2.3
v9.2.4
v9.2.5
v9.2.6
v9.2.7
v9.2.8
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.3.4
v9.3.5
v9.3.6
v9.3.7
v9.4.0
v9.4.1
v9.5.0
v9.5.1
v9.5.2
v9.6.0
v9.6.1
v9.6.2
v9.6.3
v9.6.4
v9.6.5
v9.6.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-9778-v769-qvjf/GHSA-9778-v769-qvjf.json"