Vendor
BookStackApp
24 known vulnerabilities.
Products
14 results · Clear filters · Feed
-
Medium 5.4
BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment I…
-
Medium 5.4
BookStack < 26.05.4 Broken Access Control via Image Gallery API
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery A…
-
Medium 5.3
BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control
A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to im…
-
Medium 4.3
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
-
Medium 5.3CVE-2021-4119 EPSS 27%
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
-
Medium 6.5
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
-
Medium 6.5
Path Traversal in bookstackapp/bookstack
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-
Medium 5.4
Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
-
Medium 4.3
Path Traversal in bookstackapp/bookstack
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.4
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.3
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack
bookstack is vulnerable to Server-Side Request Forgery (SSRF)
-
Medium 6.4
Server Side Request Forgery in BookStack
BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page could set certain image URL's to manipulate functionality in the exporting system, which would allow t…
-
Medium 6.3
Cross-site Scripting in BookStack
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displ…