Elgg

12 CVEs across 2 Elgg products. Browse Elgg vulnerabilities, severities, and proof-of-concept exploits.

Elgg products with known CVEs

ProductCVEs
Elgg12
Elgg/elgg3
Elgg CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-65650Medium4.32026-07-22Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.
CVE-2021-4072Medium5.42021-12-24elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3980High7.52021-12-03elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
CVE-2021-3964Medium5.92021-12-01elgg is vulnerable to Authorization Bypass Through User-Controlled Key
CVE-2011-2936Critical9.82019-11-12Elgg through 1.7.10 has a SQL injection vulnerability
CVE-2011-2935Medium6.12019-11-12Elgg through 1.7.10 has XSS
CVE-2019-11016Medium6.12019-04-08Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.
CVE-2013-02342014-02-02Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web sc…
CVE-2012-65632013-05-23engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entiti…
CVE-2012-65622013-05-23engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accou…
CVE-2012-65612013-05-23Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the vi…
CVE-2011-37332011-09-23Elgg 1.7.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message…