Roller (Apache) - vulnerabilities (CVEs)
14 CVEs, 0 in the last 30 days, 99 known versions, newest CVE from 2025-04-14. Vendor: Apache.
CVEs of Roller
- CVE-2025-24859 - CVSS 8.8 (high), 2025-04-14: A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password…
- CVE-2024-46911 - CVSS 4.7 (medium), 2024-10-14: Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are…
- CVE-2024-25090 - CVSS 5.4 (medium), 2024-07-26: Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache…
- CVE-2023-37581 - CVSS 5.4 (medium), 2023-08-06: Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms…
- CVE-2021-33580 - CVSS 7.5 (high), 2021-08-18: User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The…
- CVE-2019-0234 - CVSS 6.1 (medium), 2019-07-15: A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and…
- CVE-2018-17198 - CVSS 9.8 (critical), 2019-05-28: Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser…
- CVE-2014-0030 - CVSS 9.8 (critical), 2017-10-10: The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
- CVE-2015-0249 - CVSS 7.2 (high), 2017-07-17: The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java…
- CVE-2013-4212 - CVSS 6.8 (medium), 2013-12-07: Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the…
- CVE-2013-4171 - CVSS 4.3 (medium), 2013-12-07: Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors…
- CVE-2012-2381 - CVSS 3.5 (low), 2012-06-26: Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by…
- CVE-2012-2380 - CVSS 6.8 (medium), 2012-06-26: Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the…
- CVE-2008-6879 - CVSS 4.3 (medium), 2009-07-30: Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q…
