CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 08/03/2022 |
| CVE-2021-4194 | 中危6.5 | bookstack is vulnerable to Improper Access Control | 06/01/2022 |
| CVE-2021-4119 | 严重9.8 | bookstack is vulnerable to Improper Access Control | 15/12/2021 |
| CVE-2021-3944 | 中危6.8 | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) | 02/12/2021 |
| CVE-2021-4026 | 中危4.3 | bookstack is vulnerable to Improper Access Control | 30/11/2021 |
| CVE-2021-3915 | 中危5.7 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type | 13/11/2021 |
| CVE-2021-3916 | 中危6.5 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 05/11/2021 |
| CVE-2021-3906 | 中危6.5 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type | 27/10/2021 |
| CVE-2021-3874 | 中危6.5 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 15/10/2021 |
| CVE-2021-3768 | 中危5.4 | bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 06/09/2021 |
| CVE-2021-3767 | 中危5.4 | bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 06/09/2021 |
| CVE-2021-3758 | 中危6.5 | bookstack is vulnerable to Server-Side Request Forgery (SSRF) | 02/09/2021 |
| CVE-2020-26260 | 中危6.4 | BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page could set certain image URL's to manipulate functionality in the exporting system, which would allow them to make server side requests and/or have access to a wide | 09/12/2020 |
| CVE-2020-26211 | 高危8.7 | In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a part | 03/11/2020 |
| CVE-2020-26210 | 高危8.7 | In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you think this could have been exploited the linked advisory provid | 03/11/2020 |
| CVE-2020-11055 | 中危5.4 | In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulner | 07/05/2020 |
| CVE-2020-5256 | 高危8.8 | BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to | 09/03/2020 |