Skip to content
OpenAdvisories

Package · Packagist

passbolt/passbolt_api

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.2
    GHSA-2f46-4xjm-73x5

    Passbolt API Stored XSS on first/last name during setup

    ### Description An administrator can craft a user with a malicious first name and last name, using a payload such as ``` <svg onload="confirm(document.domain)">'); ?></svg> ``` The user will then receive the invitation email and click on the setup link. The s…

    passbolt/passbolt_api Packagist
  • High 8.1
    GHSA-cv5c-2qv5-w2m2

    Passbolt Api Remote code execution

    Passbolt provides a way for system administrators to generate a PGP key for the server during installation. The wizard requests a username, an e-mail address and an optional comment. No escaping or verification is done by Passbolt, effectively allowing a user…

    passbolt/passbolt_api Packagist