in2code/femanager (packagist) has 9 known vulnerabilities, the worst rated HIGH. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
A missing access check in the InvitationController allows an unauthenticated user with a valid invitation link to set the password of all frontend users.
CyberXYZ does not call a package safe in absolute terms. It records 9 known vulnerabilities for in2code/femanager (packagist), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does in2code/femanager have known vulnerabilities?
Yes. CyberXYZ records 9 known vulnerabilities for in2code/femanager (packagist), the worst rated HIGH. These include GHSA-mm8v-wmqx-8h2j, GHSA-3p9x-xxx6-2w4p, GHSA-rc5f-3hfv-jxp2, GHSA-xxwr-wv9g-7jw3, GHSA-4xp5-hr35-84cx.
How do I check in2code/femanager before installing?
Search in2code/femanager in CyberXYZ Check at https://cyberxyz.io/check?q=in2code%2Ffemanager. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 07:48 UTC. The most recent advisory here was published 2025-07-22. Updated continuously from NVD, GHSA, OSV and CNA feeds.