Syspass - vulnerabilities (CVEs)

7 CVEs in 1 products, 0 in the last 30 days, newest from 2025-02-28.

Products

CVE-2025-25476 - CVSS 5.4 (medium), 2025-02-28: A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by…
CVE-2025-25478 - CVSS 6.5 (medium), 2025-02-28: The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of…
CVE-2025-25477 - CVSS 8.1 (high), 2025-02-28: A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the…
CVE-2024-42904 - CVSS 6.1 (medium), 2024-09-03: A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the…
CVE-2022-4930 - CVSS 5.4 (medium), 2023-03-06: A vulnerability classified as problematic was found in nuxsmin sysPass up to 3.2.4. Affected by this vulnerability is an unknown functionality of the…
CVE-2017-9306 - CVSS 6.1 (medium), 2017-05-31: inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "<svg/onload=" substring instead of…
CVE-2017-5999 - CVSS 7.5 (high), 2017-03-06: An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that…