opensource-workshop/connect-cms
Clear licensing, a usable README, tests, and release notes support adoption. The organization has four active contributors, while unpinned workflow actions and no security policy leave modest process gaps.
84%
Total Score
100
94
50
Health Score Breakdown
Four install and update lifecycle scripts run during Composer operations, increasing installation complexity and execution exposure for consumers.
Composer build tooling is present, but no security-scanning tooling was detected, leaving a modest gap in the project's automated security process.
The repository has no security policy, which reduces transparency about vulnerability reporting and response expectations for a security-sensitive CMS.
All 28 analyzed action references are unpinned, and the audit found a high-confidence low-severity ad hoc package installation; however, there are no untrusted checkouts, script injections, or write-permission workflows.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-32300 opensource-workshop/connect-cms is vulnerable to Improper Authorization in versions 0.0.0 - 1.41.0 and 2.0.0 - 2.41.0. | 0.0.0 - 1.41.02.0.0 - 2.41.0 | High |
CVE-2026-32299 opensource-workshop/connect-cms is vulnerable to Improper Access Control in versions 0.0.0 - 1.40.0 and 2.0.0 - 2.40.0. | 0.0.0 - 1.40.02.0.0 - 2.40.0 | High |
CVE-2026-32279 opensource-workshop/connect-cms is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.0 - 1.41.0 and 2.0.0 - 2.41.0. | 0.0.0 - 1.41.02.0.0 - 2.41.0 | Medium |
CVE-2026-32278 opensource-workshop/connect-cms is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.41.0 and 2.0.0 - 2.41.0. | 0.0.0 - 1.41.02.0.0 - 2.41.0 | High |
CVE-2026-32277 opensource-workshop/connect-cms is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 1.35.0 - 1.41.1 and 2.35.0 - 2.41.1. | 1.35.0 - 1.41.12.35.0 - 2.41.1 | High |
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 laravel/ui Version ^4.0 | — | — |
mews/captcha Version 3.3.0 | — | — |
symfony/yaml Version ^5.4 | — | — |
doctrine/dbal Version ^3.0 | — | — |
setasign/fpdi Version ^2.3 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 6 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.