Embedthis Goahead
21 CVEs affecting Embedthis Goahead. Latest disclosed: 2025-07-25. Critical: 6, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41615 | Critical | 9.8 | 2022-08-08 | websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which d… |
CVE-2021-43298 | Critical | 9.8 | 2022-01-25 | The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that a… |
CVE-2021-42342 | Critical | 9.8 | 2021-10-14 | An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed… |
CVE-2019-5096 | Critical | 9.8 | 2019-12-03 | An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in version… |
CVE-2017-1000471 | Critical | 9.8 | 2018-01-03 | EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service. |
CVE-2017-5674 | Critical | 9.8 | 2017-03-13 | A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malforme… |
CVE-2020-15688 | High | 8.8 | 2020-07-23 | The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote… |
CVE-2017-5675 | High | 8.8 | 2017-03-13 | A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera… |
CVE-2019-16645 | High | 8.6 | 2019-09-20 | An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtaine… |
CVE-2017-17562 | High | 8.1 | 2017-12-12 | Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the env… |
CVE-2019-5097 | High | 7.5 | 2019-12-03 | A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4… |
CVE-2019-12822 | High | 7.5 | 2019-06-14 | In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assertion, out-of-bounds memory reference, and… |
CVE-2018-15505 | High | 7.5 | 2018-08-18 | An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause… |
CVE-2018-15504 | High | 7.5 | 2018-08-18 | An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which r… |
CVE-2017-14149 | High | 7.5 | 2017-09-05 | GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a "POST / HTTP/1.1" request. |
CVE-2023-53155 | High | 7.2 | 2025-07-25 | goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter. |
CVE-2024-3187 | Medium | 5.9 | 2024-10-17 | This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values not… |
CVE-2024-3184 | Medium | 5.9 | 2024-10-17 | Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAHEAD_REPLACE_MALLOC… |
CVE-2024-3186 | Medium | 5.3 | 2024-10-17 | CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the ME_GOAHEAD_JAVASCRIPT… |
CVE-2019-19240 | Medium | 5.3 | 2019-11-22 | Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limi… |