← Back

Wallabag

wallabag

10 CVEs • 1 product

Products (1)

Click to collapse
Toggle
Wallabag
wallabag
10 CVEs

CVEs (10)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-0737
1Wallabag
1Wallabag
Nov 19, 2024
Nov 15, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.
CVE-2023-4455
1Wallabag
1Wallabag
Nov 21, 2024
Aug 21, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
CVE-2023-4454
1Wallabag
1Wallabag
Nov 21, 2024
Aug 21, 2023
N/A· v4
5.7 MEDIUM· v3
N/A· v2
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
CVE-2023-3566
1Wallabag
1Wallabag
Nov 21, 2024
Jul 10, 2023
N/A· v4
6.5 MEDIUM· v3
2.7 LOW· v2
A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the ar...Show more
A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of resources. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233359. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-0734
1Wallabag
1Wallabag
Nov 21, 2024
Mar 5, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.
CVE-2023-0736
1Wallabag
1Wallabag
Nov 21, 2024
Feb 7, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
CVE-2023-0735
1Wallabag
1Wallabag
Nov 21, 2024
Feb 7, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
CVE-2023-0610
1Wallabag
1Wallabag
Nov 21, 2024
Feb 1, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
CVE-2023-0609
1Wallabag
1Wallabag
Nov 21, 2024
Feb 1, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
CVE-2018-11352
1Wallabag
1Wallabag
Nov 21, 2024
Sep 21, 2018
N/A· v4
4.0 MEDIUM· v3
2.1 LOW· v2
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time...Show more
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions.Show less