bigbluebutton

10 results · Clear filters · Feed

• High 7.1
  CVE-2026-46355

  BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser

  BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to su…

  bigbluebutton bigbluebutton
  Aug 20, 2026
• High 8.5
  CVE-2026-46682

  BigBlueButton: Blind SQL Injection AUTH (Moderator)

  BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebut…

  bigbluebutton bigbluebutton
  Aug 20, 2026
• High 8.1
  CVE-2026-46353

  BigBlueButton API checksum bypass via presentationUploadExternalUrl

  BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a …

  bigbluebutton bigbluebutton
  Jul 16, 2026
• High 8.1
  CVE-2026-46351

  BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them

  BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in bbb-common-web/src/main/java/org/bigbluebutton/api/Util.java and bigbluebutton-web/grails-app/control…

  bigbluebutton bigbluebutton
  Jul 16, 2026
• High 7.2
  CVE-2026-27466

  BigBlueButton: Exposed ClamAV port enables Denial of Service

  BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Se…

  bigbluebutton bigbluebutton
  Feb 21, 2026
• High 7.5
  CVE-2025-61602

  BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId

  BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed `reactionEmojiId` in …

  bigbluebutton bigbluebutton
  Oct 9, 2025
• High 7.5
  CVE-2025-61601

  BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation

  BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a…

  bigbluebutton bigbluebutton
  Oct 9, 2025
• High 7.1
  CVE-2025-55200

  BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes

  BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the "Shared Notes" feature contains a Stored Cross-Site Scripting (XSS) vulnerability with the input location being the "Username" field and the output location on the "Shared Not…

  bigbluebutton bigbluebutton
  Oct 9, 2025
• High 7.5
  CVE-2022-29169

  ReDoS on endpoint html5client/useragent in BigBlueButton

  BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cau…

  bigbluebutton bigbluebutton
  Jun 1, 2022
• High 8.1
  CVE-2021-4143

  Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton

  Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.

  bigbluebutton bigbluebutton/bigbluebutton
  Jan 19, 2022