Skip to content
OpenAdvisories

Package · Packagist

wallabag/wallabag

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • Medium 4.3
    GHSA-5pm7-cp8f-p2c2

    wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities

    ## Impact wallabag versions prior to 2.6.11 were discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities across several endpoints. An attacker could craft a malicious link or page that, if visited by a logged-in wallabag user, could t…

    wallabag/wallabag Packagist
  • Medium 6.5
    CVE-2023-0737

    CSRF in wallabag/wallabag

    wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Medium 4.3
    GHSA-56fm-hfp3-x3w3

    Wallabag user can disable 2FA unintentionally

    ## Impact wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily disable 2FA through `/config/otp/app/disable` and `/config/otp/email/disable`. This vulnerability has a CVSSv3.1 score of 4.3. **You should …

    wallabag/wallabag Packagist
  • Medium 6.5
    CVE-2023-4455

    Cross-Site Request Forgery (CSRF) in wallabag/wallabag

    Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Medium 4.3
    CVE-2023-4454

    Cross-Site Request Forgery (CSRF) in wallabag/wallabag

    Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Low 3.5
    CVE-2023-3566

    wallabag Profile Config config allocation of resources

    A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of reso…

    wallabag/wallabag Packagist
  • High 7.3
    CVE-2023-0734

    Improper Authorization in wallabag/wallabag

    Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Medium 6.5
    CVE-2023-0735

    Cross-Site Request Forgery (CSRF) in wallabag/wallabag

    Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Medium 4.6
    CVE-2023-0736

    Cross-site Scripting (XSS) - Stored in wallabag/wallabag

    Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Medium 6.5
    CVE-2023-0609

    Improper Authorization in wallabag/wallabag

    Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Medium 5.4
    CVE-2023-0610

    Improper Authorization in wallabag/wallabag

    Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.

    wallabag wallabag/wallabag wallabag/wallabag Packagist
  • Medium 4.0
    CVE-2018-11352

    Wallabag cross-site scripting (XSS) vulnerability

    The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configurat…

    wallabag/wallabag Packagist