GHSA-5j8p-438x-rgg5
NoneCVSS
—
EPSS
—
Published
Dec 9, 2025
CISA due date
—
The record
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | onelogin/php-saml | 0 | 2.21.1 |
| Packagist | onelogin/php-saml | 3.0.0 | 3.8.1 |
| Packagist | onelogin/php-saml | 4.0.0 | 4.3.1 |
| packagist | onelogin/php-saml | 3.0.0 | 3.8.1 |
| packagist | onelogin/php-saml | 4.0.0 | 4.3.1 |
Related vulnerabilities
- GHSA-39h7-pwv7-rc3x Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) CWE-1395
- GHSA-hw5x-4r37-72w7 OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with… CWE-1395
- GHSA-3hfp-gqgh-xc5g Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios… CWE-1395
- GHSA-658g-p7jg-wx5g Axios npm Supply Chain Incident Impacting @usebruno/cli CWE-1395
- GHSA-w2fm-25vw-vh7f mcp-handler has a tool response leak across concurrent client sessions ('Race Condition') CWE-1395
- GHSA-32wq-ppwg-3w4m EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency… CWE-1395
- GHSA-46wh-3698-f2cx Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go… CWE-1395
- GHSA-vj2p-7pgw-g2wf Postiz App has a High-Severity SSRF Vulnerability via Next.js CWE-1395