Scan report

claroline / Claroline

View on GitHub (opens in a new tab)
PHP
344 stars
Scanned 29 Jul 2026, 15:18

Report Rescan

Vulnerability Safe

Could an attacker exploit mistakes in this code?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

1 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 0
Low: 46

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

46 total findings

Likely real: 0
Uncertain: 0
Likely noise: 46

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

All 46 findings look like noise (low confidence) — nothing here likely needs attention.

Detections by engine

Dependency checker 45

CVEs, typosquats and risky installs · Supply chain
YARA 1

Malware signature rules · Malicious pattern

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 8% confidence

Loose version constraint: 'webpack-dev-server^5.2' — attacker could push malicious update
```
webpack-dev-server:^5.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 4% confidence

Loose version constraint: 'html-react-parser^5.1.10' — attacker could push malicious update
```
html-react-parser:^5.1.10
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'reselect^5.1' — attacker could push malicious update
```
reselect:^5.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'react-bootstrap^2.10' — attacker could push malicious update
```
react-bootstrap:^2.10
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'react-dnd^7.7.0' — attacker could push malicious update
```
react-dnd:^7.7.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'react-dnd-html5-backend^7.0.2' — attacker could push malicious update
```
react-dnd-html5-backend:^7.0.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'react-dnd-touch-backend^0.5.2' — attacker could push malicious update
```
react-dnd-touch-backend:^0.5.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'react-helmet^6.1.0' — attacker could push malicious update
```
react-helmet:^6.1.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'react-redux^9.1' — attacker could push malicious update
```
react-redux:^9.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'react-router-dom^5.0.0' — attacker could push malicious update
```
react-router-dom:^5.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'recharts^2.15' — attacker could push malicious update
```
recharts:^2.15
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'redux^4.0.1' — attacker could push malicious update
```
redux:^4.0.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'redux-thunk^2.3.0' — attacker could push malicious update
```
redux-thunk:^2.3.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'redux-freeze^0.1.7' — attacker could push malicious update
```
redux-freeze:^0.1.7
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'swagger-ui-react^5.32' — attacker could push malicious update
```
swagger-ui-react:^5.32
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'tinycolor2^1.6.0' — attacker could push malicious update
```
tinycolor2:^1.6.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'tinymce^7.7' — attacker could push malicious update
```
tinymce:^7.7
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'uuid^9.0.0' — attacker could push malicious update
```
uuid:^9.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'video.js^8.21' — attacker could push malicious update
```
video.js:^8.21
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'webpack^5.105' — attacker could push malicious update
```
webpack:^5.105
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'webpack-cli^6.0' — attacker could push malicious update
```
webpack-cli:^6.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'circular-dependency-plugin^5.2.2' — attacker could push malicious update
```
circular-dependency-plugin:^5.2.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'eslint^7.15.0' — attacker could push malicious update
```
eslint:^7.15.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'eslint-plugin-react^7.21.5' — attacker could push malicious update
```
eslint-plugin-react:^7.21.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'postcss^8.4.31' — attacker could push malicious update
```
postcss:^8.4.31
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@babel/core^7.26' — attacker could push malicious update
```
@babel/core:^7.26
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@babel/plugin-syntax-dynamic-import^7.8.3' — attacker could push malicious update
```
@babel/plugin-syntax-dynamic-import:^7.8.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@babel/preset-env^7.10.2' — attacker could push malicious update
```
@babel/preset-env:^7.10.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@babel/preset-react^7.10.1' — attacker could push malicious update
```
@babel/preset-react:^7.10.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@fortawesome/fontawesome-free^6' — attacker could push malicious update
```
@fortawesome/fontawesome-free:^6
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@tinymce/tinymce-react^6.0' — attacker could push malicious update
```
@tinymce/tinymce-react:^6.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'autoprefixer^10.4.0' — attacker could push malicious update
```
autoprefixer:^10.4.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'babel-loader^8.0.0' — attacker could push malicious update
```
babel-loader:^8.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'bootstrap^5.3' — attacker could push malicious update
```
bootstrap:^5.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'classnames^2.3.2' — attacker could push malicious update
```
classnames:^2.3.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'core-js^3.31.0' — attacker could push malicious update
```
core-js:^3.31.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'cssnano^6.0.1' — attacker could push malicious update
```
cssnano:^6.0.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'd3^7.9.0' — attacker could push malicious update
```
d3:^7.9.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'flag-icons^7.1' — attacker could push malicious update
```
flag-icons:^7.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'invariant^2.2.4' — attacker could push malicious update
```
invariant:^2.2.4
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'jsplumb^2.2.11' — attacker could push malicious update
```
jsplumb:^2.2.11
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'lodash^4.18.1' — attacker could push malicious update
```
lodash:^4.18.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'moment^2.30' — attacker could push malicious update
```
moment:^2.30
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'pdfjs-dist^4.10' — attacker could push malicious update
```
pdfjs-dist:^4.10
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'prop-types^15.8.1' — attacker could push malicious update
```
prop-types:^15.8.1
```