Embedthis - vulnerabilities (CVEs)

26 CVEs in 3 products, 0 in the last 30 days, newest from 2025-07-25.

Products

• Goahead - 18 CVEs
• Appweb - 6 CVEs
• Goahead Web Server - 1 CVEs

Newest CVEs of Embedthis

• CVE-2023-53155 - CVSS 7.2 (high), 2025-07-25: goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter.
• CVE-2024-3187 - CVSS 5.9 (medium), 2024-10-17: This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values…
• CVE-2024-3186 - CVSS 5.3 (medium), 2024-10-17: CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the…
• CVE-2024-3184 - CVSS 5.9 (medium), 2024-10-17: Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the…
• CVE-2021-41615 - CVSS 9.8 (critical), 2022-08-08: websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which…
• CVE-2021-33254 - CVSS 7.5 (high), 2022-06-02: An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream…
• CVE-2021-43298 - CVSS 9.8 (critical), 2022-01-25: The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that…
• CVE-2021-42342 - CVSS 9.8 (critical), 2021-10-14: An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being…
• CVE-2020-15688 - CVSS 8.8 (high), 2020-07-23: The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated…
• CVE-2020-15689 - CVSS 7.5 (high), 2020-07-13: Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may…
• CVE-2019-5097 - CVSS 7.5 (high), 2019-12-03: A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1,…
• CVE-2019-5096 - CVSS 9.8 (critical), 2019-12-03: An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in…
• CVE-2019-19240 - CVSS 5.3 (medium), 2019-11-22: Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a…
• CVE-2019-16645 - CVSS 8.6 (high), 2019-09-20: An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname…
• CVE-2019-12822 - CVSS 7.5 (high), 2019-06-14: In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assertion, out-of-bounds memory reference,…
• CVE-2018-15504 - CVSS 7.5 (high), 2018-08-18: An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which…
• CVE-2018-15505 - CVSS 7.5 (high), 2018-08-18: An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause…
• CVE-2018-8715 - CVSS 8.1 (high), 2018-03-15: The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP…
• CVE-2017-1000470 - CVSS 7.5 (high), 2018-01-03: EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of service.
• CVE-2017-1000471 - CVSS 9.8 (critical), 2018-01-03: EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service.
• CVE-2017-17562 - CVSS 8.1 (high), 2017-12-12: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the…
• CVE-2017-14149 - CVSS 7.5 (high), 2017-09-05: GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a "POST / HTTP/1.1" request.
• CVE-2017-5675 - CVSS 8.8 (high), 2017-03-13: A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP…
• CVE-2017-5674 - CVSS 9.8 (critical), 2017-03-13: A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a…
• CVE-2014-9708 - CVSS 5 (medium), 2015-03-31: Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an…
• CVE-2014-9707 - CVSS 7.5 (high), 2015-03-31: EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot), which allows remote attackers to conduct directory…