Skip to content
OpenAdvisories

Vendor

ifmeorg

5 known vulnerabilities.

Products

ifme 5
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.7
    CVE-2021-25991

    ifme - Improper Access Control leads to admin deactivation

    In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.

    ifmeorg ifme
  • Medium 5.4
    CVE-2021-25990

    ifme - Stored Cross-Site Scripting (XSS) in Contacts section

    In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.

    ifmeorg ifme
  • Medium 5.4
    CVE-2021-25989

    ifme - Stored Cross-Site Scripting (XSS) in Groups section

    In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.

    ifmeorg ifme
  • Medium 5.4
    CVE-2021-25988

    ifme - Stored Cross-Site Scripting (XSS) in Notifications section

    In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.

    ifmeorg ifme