CVE-2025-62604 | High | 7.5 | 2025-10-22 | MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allo… |
CVE-2025-53639 | Critical | 9.8 | 2025-07-14 | MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validat… |
CVE-2024-37161 | Medium | 4.0 | 2024-06-11 | MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting vulnerabilities. V… |
CVE-2024-36118 | Low | 3.5 | 2024-05-30 | MeterSphere is a test management and interface testing tool. In affected versions users without workspace permissions can view functional test cases of other w… |
CVE-2024-32467 | Medium | 5.7 | 2024-04-25 | MeterSphere is an open source continuous testing platform. Prior to version 2.10.14-lts, members without space permissions can view member information from oth… |
CVE-2023-50267 | Medium | 4.3 | 2023-12-28 | MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to… |
CVE-2023-41878 | Medium | 4.6 | 2023-09-27 | MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance test… |
CVE-2023-38494 | Medium | 5.9 | 2023-08-04 | MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configu… |
CVE-2023-37461 | Medium | 5.6 | 2023-07-17 | Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which ma… |
CVE-2023-35937 | Medium | 6.0 | 2023-07-06 | Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows or… |
CVE-2023-32699 | Medium | 6.5 | 2023-05-30 | MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. The `checkUserPassword` method is used… |
CVE-2023-29944 | Critical | 9.8 | 2023-05-08 | Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet functi… |
CVE-2023-30550 | Medium | 6.8 | 2023-05-04 | MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. Th… |
CVE-2023-25814 | High | 7.1 | 2023-03-09 | metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations… |
CVE-2023-25573 | High | 8.6 | 2023-03-09 | metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`… |
CVE-2022-46178 | High | 7.4 | 2022-12-29 | MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions pr… |
CVE-2022-23544 | High | 7.2 | 2022-12-28 | MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions pr… |
CVE-2022-23512 | High | 7.7 | 2022-12-14 | MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFi… |
CVE-2021-45790 | Critical | 9.8 | 2022-09-29 | An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, where attackers can… |
CVE-2021-45789 | Medium | 6.5 | 2022-09-29 | An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function. |
CVE-2021-45788 | High | 8.8 | 2022-09-29 | Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter. |