CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9. |
| 23/05/2022 |
| CVE-2022-1810 | MEDIO4.3 | Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9. | 23/05/2022 |
| CVE-2022-1553 | MEDIO4.9 | Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users. | 16/05/2022 |
| CVE-2022-0578 | MEDIO6.5 | Code Injection in GitHub repository publify/publify prior to 9.2.8. | 16/05/2022 |
| CVE-2022-0574 | MEDIO6.5 | Improper Access Control in GitHub repository publify/publify prior to 9.2.8. | 16/05/2022 |
| CVE-2022-0524 | ALTO7.5 | Business Logic Errors in GitHub repository publify/publify prior to 9.2.7. | 08/02/2022 |
| CVE-2021-25975 | MEDIO5.4 | In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file. | 10/11/2021 |
| CVE-2021-25974 | MEDIO5.4 | In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article. | 10/11/2021 |
| CVE-2021-25973 | MEDIO6.5 | In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only. | 02/11/2021 |