Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

universal-omega/dynamic-page-list3

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7PackagistPublished

    DynamicPageList3 vulnerability exposes hidden/suppressed usernames

    CVE-2025-53625 · GHSA-7pgw-q3qp-6pgq

    Affected
    • Packagist universal-omega/dynamic-page-list3 < 3.6.4
    Fixed in
    3.6.4· Vendor fix available
    Issue
    Several #dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. Details The parameters adduser, addauthor, and addlasteditor output the page creator or last editor using the %USER% placeholder. These display the actual username, even when that name has been hidden using revision deletion, suppression (oversight), or hideuser. The %CONTRIBUTOR% placeholder, used with addcontribution, behaves similarly and also reveals hidden usernames. In addition, the following parameters can expose suppressed usernames when combined with %USER% or similar output placeholders: - lastrevisionbefore - allrevisionsbefore - firstrevisionsince - allrevisionssince These parameters reference specific revisions and allow output of user-related metadata. If a username has been hidden from those revisions, it may still appear in the output. Further, the parameters createdby, notcreatedby, modifiedby, notmodifiedby, lastmodifiedby, and…

    Recommended action: Upgrade to 3.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →