The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modification.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NXwiki Cryptpad
APPXwiki< 3.0.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Powiązane podatności
CVE-2025-51846HIGH8.7ten sam produkt
CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly...
CVE-2025-49591HIGH7.4ten sam produkt
CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) i...
CVE-2017-1000051MEDIUM6.1ten sam produkt
Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attac...
CVE-2025-49590LOW2.9ten sam produkt
CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to fil...
CVE-2025-24893CRITICAL9.8⚠ KEVPL ✓ten sam vendor
XWiki Platform — niezautoryzowany RCE przez endpoint SolrSearch