Passbolt Api

passbolt_api

Vendor: Passbolt • 3 CVEs

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-27913 1Passbolt 1Passbolt Api Jun 17, 2026 Mar 10, 2025 2.1 LOW· v4 7.5 HIGH· v3 N/A· v2 Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP H...Show more Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.Show less
CVE-2024-33670 1Passbolt 1Passbolt Api Jun 17, 2026 Apr 26, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Conte...Show more Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.Show less
CVE-2017-1000442 1Passbolt 1Passbolt Api Nov 21, 2024 Jan 2, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace