Skip to content
OpenAdvisories

Vendor

Hallo Welt!

18 known vulnerabilities.

Products

BlueSpice 17 Common User Interface Component 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.6
    CVE-2026-24732

    Improper permission checks in Extension:NSFileRepo

    Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing El…

    Hallo Welt! BlueSpice
  • Medium 5.9
    CVE-2025-58114

    Potential XSS in Extension:CognitiveProcessDesigner

    Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects BlueSpice: from 5 through 5.1.1.

    Hallo Welt! BlueSpice
  • Medium 5.9
    CVE-2025-57880

    Potential XSS in Extension:BlueSpiceWhoIsOnline

    Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1.

    Hallo Welt! BlueSpice
  • Medium 5.9
    CVE-2025-48007

    Potential XSS in Extension:BlueSpiceAvatars

    Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1.

    Hallo Welt! BlueSpice
  • Medium 5.9
    CVE-2025-46703

    Potential XSS in Extension:AtMentions

    Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1.

    Hallo Welt! BlueSpice
  • Medium 4.0
    CVE-2022-3895

    Potential XSS in common user interface component library

    Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS).

    Hallo Welt! Common User Interface Component
  • Medium 4.3
    CVE-2022-2510

    Potential XSS on Special:SearchCenter

    Cross-site Scripting (XSS) vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page "Special:SearchCenter", using the search term in the URL.

    Hallo Welt! BlueSpice
  • Medium 4.3
    CVE-2022-2511

    Potential XSS in title URL parameter

    Cross-site Scripting (XSS) vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of the call URL.

    Hallo Welt! BlueSpice