Skip to main content

CVE mentions, exploit signals, and PoC evidence in one fast public view.

Vendor/product archive

xwiki / cryptpad CVEs

Beta · best-effort

5 CVEs tagged to xwiki / cryptpad — 0 Critical, 2 High, 2 Medium, 1 Low, 0 Unrated.

See this archive with more filters Back to xwiki vendor archive

CVE-2025-51846

Published Apr 30, 2026

CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed…

CVSS 8.7 · High

Vendor/product tagsBeta · best-effort

CVE-2025-49591

Published Jun 18, 2025

CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of a…

CVSS 7.4 · High

Vendor/product tagsBeta · best-effort

CVE-2025-49590

Published Jun 18, 2025

CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however th…

CVSS 2.9 · Low

Vendor/product tagsBeta · best-effort

CVE-2019-15302

Published Sep 11, 2019

The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., caus…

CVSS 6.5 · Medium

Vendor/product tagsBeta · best-effort

CVE-2017-1000051

Published Jul 17, 2017

Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the pad content

CVSS 6.1 · Medium

Vendor/product tagsBeta · best-effort

Showing 1-5 of 5 CVEsPage 1 of 1