Xwiki Cryptpad
5 CVEs affecting Xwiki Cryptpad. Latest disclosed: 2026-04-30. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49591 | Critical | 9.1 | 2025-06-18 | CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak… |
CVE-2025-51846 | High | 7.5 | 2026-04-30 | CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a Crypt… |
CVE-2019-15302 | Medium | 6.5 | 2019-09-11 | The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to co… |
CVE-2025-49590 | Medium | 6.1 | 2025-06-18 | CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripti… |
CVE-2017-1000051 | Medium | 6.1 | 2017-07-17 | Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via t… |