Skip to content
OpenAdvisories

Vendor

ether

10 known vulnerabilities.

Products

etherpad 6 Catalyst::Plugin::Authentication 1 etherpad-lite 1 FCGI 1 Catalyst::Authentication::Credential::HTTP 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-55085

    Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite

    Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTM…

    ether etherpad
  • Critical 9.9
    CVE-2026-55089

    Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint

    Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that th…

    ether etherpad
  • Critical 9.1
    CVE-2009-10007

    Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks

    Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can…

    ether Catalyst::Plugin::Authentication libcatalyst-plugin-authentication-perl libcatalyst-plugin-authentication-perl Debian Ubuntu
  • Critical 9.9
    CVE-2021-43802

    Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports

    Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a mal…

    ether etherpad-lite