webreinvent/vaahcms

VaahCMS is a laravel based open-source web application development platform shipped with headless content management system.

View on Packagist

View on Github

Activity

Latest release: 10mo ago
Total releases: 167
Cadence: ~5 days
Last 12 months: 3

Reach

Stars: —

Details

License: MIT
First release: May 15, 2019

Releases

Version	Released
`2.3.4` patch	Nov 04, 2025
`2.3.3` patch	Nov 03, 2025
`2.3.2` patch	Oct 25, 2025
`2.3.1` patch 1 CVE	Jul 22, 2025
`2.3.0` minor 1 CVE	Jul 01, 2025
`2.2.14` patch 1 CVE	Jun 30, 2025
`2.2.13` patch 1 CVE	Jun 26, 2024
`2.2.12` patch 1 CVE	Jun 03, 2024
`2.2.11` patch 1 CVE	May 06, 2024
`2.2.10` patch 1 CVE	May 06, 2024
`2.2.9` patch 1 CVE	Mar 20, 2024
`2.2.8` patch 1 CVE	Mar 15, 2024
`2.2.7` patch 1 CVE	Mar 13, 2024
`2.2.6` patch 1 CVE	Mar 12, 2024
`2.2.5` patch 1 CVE	Jan 23, 2024
`2.2.4` patch 1 CVE	Jan 22, 2024
`2.2.3` patch 1 CVE	Jan 04, 2024
`2.2.2` patch 1 CVE	Dec 27, 2023
`2.2.1` patch 1 CVE	Dec 26, 2023
`2.2.0` minor 1 CVE	Dec 12, 2023
`2.1.10` patch 1 CVE	Nov 15, 2023
`2.1.9` patch 1 CVE	Nov 15, 2023
`2.1.8` patch 1 CVE	Nov 14, 2023
`2.1.7` patch 1 CVE	Nov 09, 2023
`2.1.6` patch 1 CVE	Nov 04, 2023
`2.1.5` patch 1 CVE	Oct 16, 2023
`2.1.4` patch 1 CVE	Sep 29, 2023
`2.1.3` patch 1 CVE	Sep 28, 2023
`2.1.2` patch 1 CVE	Sep 05, 2023
`2.1.1` patch 1 CVE	Sep 01, 2023
`2.1.0` minor 1 CVE	Aug 24, 2023
`2.0.10` patch 1 CVE	Aug 23, 2023
`2.0.9` patch 1 CVE	Aug 19, 2023
`2.0.8` patch 1 CVE	Jul 11, 2023
`2.0.7` patch 1 CVE	Jul 10, 2023
`2.0.6` patch 1 CVE	Jul 07, 2023
`1.8.7` patch 1 CVE	Jun 27, 2023
`1.8.6` patch 1 CVE	Jun 27, 2023
`2.0.5` patch 1 CVE	Jun 09, 2023
`1.8.5` patch 1 CVE	Jun 05, 2023
`2.0.4` patch 1 CVE	Jun 05, 2023
`1.8.4` patch 1 CVE	Jun 05, 2023
`2.0.3` patch 1 CVE	Jun 05, 2023
`1.8.3` patch 1 CVE	Jun 05, 2023
`2.0.2` patch 1 CVE	May 23, 2023
`2.0.1` patch 1 CVE	May 19, 2023
`2.0.0` major 1 CVE	May 06, 2023
`1.8.2` patch 1 CVE	Mar 18, 2023
`1.8.1` patch 1 CVE	Mar 03, 2023
`1.8.0` minor 1 CVE	Feb 24, 2023

1–50 of 167

Repository

webreinvent/vaahcms

Forks: —
Open issues: —

Dependencies (7)

Depends on

2.3.4

Supply-chain exposure

Known CVEs (1)

CVE-2025-61183 GHSA-q769-phqg-263r Oct 08, 2025

VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

6.1 / 10
Medium
Network Low None Required Changed Low Low None

Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php

Affected versions

0.0.100.0.20.0.30.0.50.0.60.0.80.1.00.1.10.1.20.1.30.1.50.1.6

+ 152 more Show less

0.1.70.1.80.2.10.2.100.2.110.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.20.3.50.3.60.3.70.3.80.3.90.4.00.4.30.4.41.0.01.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.31.2.41.2.51.3.01.3.11.3.21.3.31.4.01.4.31.4.41.4.51.4.61.5.01.5.11.5.21.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.101.6.111.6.121.6.131.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.7.01.7.11.7.101.7.111.7.121.7.131.7.141.7.151.7.161.7.171.7.181.7.21.7.31.7.41.7.51.7.61.7.71.7.81.7.91.8.01.8.11.8.21.8.31.8.41.8.51.8.61.8.72.0.02.0.12.0.102.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.12.1.102.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.12.2.102.2.112.2.122.2.132.2.142.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.1

References

https://nvd.nist.gov/vuln/detail/CVE-2025-61183
https://github.com/webreinvent/vaahcms/issues/301
https://github.com/thawphone/CVE-2025-61183
https://github.com/webreinvent/vaahcms

Updated Oct 09, 2025 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 2
minor 15
patch 149

167 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2025

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More