Skip to content
OpenAdvisories

Product · vaadin

framework

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.8
    CVE-2025-15022

    Cross-site scripting in Action caption

    Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used b…

    vaadin vaadin framework vaadin-spreadsheet-flow Maven
  • Medium 5.3
    CVE-2025-9467

    Possibility to bypass file upload validation on the server-side

    When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue inc…

    vaadin vaadin framework vaadin-upload-flow Maven