wallabag/wallabag

10 results · Clear filters · Feed

• Medium 4.3
  GHSA-5pm7-cp8f-p2c2

  wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities

  ## Impact wallabag versions prior to 2.6.11 were discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities across several endpoints. An attacker could craft a malicious link or page that, if visited by a logged-in wallabag user, could t…

  wallabag/wallabag Packagist
  Apr 9, 2025
• Medium 6.5
  CVE-2023-0737

  CSRF in wallabag/wallabag

  wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.

  wallabag wallabag/wallabag wallabag/wallabag Packagist
  Nov 15, 2024
• Medium 4.3
  GHSA-56fm-hfp3-x3w3

  Wallabag user can disable 2FA unintentionally

  ## Impact wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily disable 2FA through `/config/otp/app/disable` and `/config/otp/email/disable`. This vulnerability has a CVSSv3.1 score of 4.3. **You should …

  wallabag/wallabag Packagist
  Oct 2, 2023
• Medium 6.5
  CVE-2023-4455

  Cross-Site Request Forgery (CSRF) in wallabag/wallabag

  Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

  wallabag wallabag/wallabag wallabag/wallabag Packagist
  Aug 21, 2023
• Medium 4.3
  CVE-2023-4454

  Cross-Site Request Forgery (CSRF) in wallabag/wallabag

  Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

  wallabag wallabag/wallabag wallabag/wallabag Packagist
  Aug 21, 2023
• Medium 6.5
  CVE-2023-0735

  Cross-Site Request Forgery (CSRF) in wallabag/wallabag

  Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.

  wallabag wallabag/wallabag wallabag/wallabag Packagist
  Feb 7, 2023
• Medium 4.6
  CVE-2023-0736

  Cross-site Scripting (XSS) - Stored in wallabag/wallabag

  Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.

  wallabag wallabag/wallabag wallabag/wallabag Packagist
  Feb 7, 2023
• Medium 6.5
  CVE-2023-0609

  Improper Authorization in wallabag/wallabag

  Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.

  wallabag wallabag/wallabag wallabag/wallabag Packagist
  Feb 1, 2023
• Medium 5.4
  CVE-2023-0610

  Improper Authorization in wallabag/wallabag

  Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.

  wallabag wallabag/wallabag wallabag/wallabag Packagist
  Feb 1, 2023
• Medium 4.0
  CVE-2018-11352

  Wallabag cross-site scripting (XSS) vulnerability

  The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configurat…

  wallabag/wallabag Packagist
  Sep 21, 2018