Beego

beego

12 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (12)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-30223 1Beego 1Beego Aug 1, 2025 Mar 31, 2025 N/A· v4 9.6 CRITICAL· v3 N/A· v2 Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled d...Show more Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.Show less
CVE-2024-55885 1Beego 1Beego Aug 1, 2025 Dec 12, 2024 6.9 MEDIUM· v4 7.5 HIGH· v3 N/A· v2 beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerab...Show more beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256.Show less
CVE-2024-40465 1Beego 1Beego Aug 15, 2024 Jul 31, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file
CVE-2024-40464 1Beego 1Beego Aug 15, 2024 Jul 31, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file
CVE-2022-31836 1Beego 1Beego Nov 21, 2024 Jul 5, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
CVE-2022-31259 1Beego 1Beego Nov 21, 2024 May 21, 2022 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g.,...Show more The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).Show less
CVE-2021-30080 1Beego 1Beego Nov 21, 2024 Apr 5, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.
CVE-2021-27117 1Beego 1Beego Nov 21, 2024 Apr 5, 2022 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.
CVE-2021-27116 1Beego 1Beego Nov 21, 2024 Apr 5, 2022 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.
CVE-2021-39391 1Beego 1Beego Nov 21, 2024 Sep 14, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.
CVE-2019-16355 1Beego 1Beego Nov 21, 2024 Sep 16, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.
CVE-2019-16354 1Beego 1Beego Nov 21, 2024 Sep 16, 2019 N/A· v4 4.7 MEDIUM· v3 1.9 LOW· v2 The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.