← Back

Phoenixframework

phoenixframework

3 CVEs • 2 products

Products (2)

Click to collapse
Toggle
Phoenix
phoenix
2 CVEs
Phoenix Html
phoenix_html
1 CVE

CVEs (3)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-46871
1Phoenixframework
1Phoenix Html
Apr 9, 2025
Jan 10, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.
CVE-2022-42975
1Phoenixframework
1Phoenix
May 10, 2025
Oct 17, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.
CVE-2017-1000163
1Phoenixframework
1Phoenix
May 13, 2026
Nov 17, 2017
N/A· v4
6.1 MEDIUM· v3
5.8 MEDIUM· v2
The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.