CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697

Fathom Lite (v1.3.1) has a stored XSS in the analytics collection endpoint (/collect). An unauthenticated user can supply crafted hostname and pathname to inject a javascript: URI, since parseHostname/parsePathname perform no URI scheme validation. The payload is stored and later rendered as an a...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697: Improper Neutralization of Input During Web Page Generation

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2018-25285

Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of...

CVE-2018-25285 Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow

Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of...

CVE-2018-25285 Fathom 2.4 Denial of Service via Authorization Code Buffer Overflow

Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of...

CVE-2018-25285

Fathom 2.4 contains a buffer overflow in the Authorization Code field that can crash the application via an oversized input. An attacker with local access can trigger this by submitting a 6000-byte payload and activating it. CVSS metrics are provided (v3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; ba...

EUVD-2018-21805

Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of...

CVE-2018-25285

Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of...

Fathom security vulnerabilities

Fathom is an analysis tool developed by Fathom Inc. that processes website access data and provides privacy-friendly statistics. Version 2.4 of Fathom has a security vulnerability. This vulnerability stems from a buffer overflow in the Authorization Code field, which could allow local attackers t...

CVE-2018-25285: Buffer Copy without Checking Size of Input

Fathom 2.4 contains a buffer overflow vulnerability in the Authorization Code field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 6000-byte payload into the Authorization Code field and click Activate to trigger a denial of...

com.gitblit.fathom:fathom-core (>=0.8.0, <=0.8.1), com.gitblit.fathom:fathom-eventbus (>=0.8.0, <=0.8.1) +46 more potentially affected by CVE-2026-3260 via io.undertow:undertow-core (1.3.16.final)

io.undertow:undertow-core MAVEN version 1.3.16.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.gitblit.fathom:fathom-core =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0,...

com.gitblit.fathom:fathom-core (>=0.9.1, <=0.9.2), com.gitblit.fathom:fathom-eventbus (>=0.9.1, <=0.9.2) +61 more potentially affected by CVE-2026-3260 via io.undertow:undertow-core (1.4.3.final)

io.undertow:undertow-core MAVEN version 1.4.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.gitblit.fathom:fathom-core =0.9.1, =0.9.1, =0.9.1, =0.9.1, =0.9.1, =0.9.1, =0.9.1, =0.9.1, =0.9.1,...

com.gitblit.fathom:fathom-core (0.7.0), com.gitblit.fathom:fathom-eventbus (0.7.0) +50 more potentially affected by CVE-2026-3260 via io.undertow:undertow-core (1.3.5.final)

io.undertow:undertow-core MAVEN version 1.3.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.gitblit.fathom:fathom-core 0.7.0 - com.gitblit.fathom:fathom-eventbus 0.7.0 -...

com.gitblit.fathom:fathom-core (0.7.0), com.gitblit.fathom:fathom-eventbus (0.7.0) +50 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.3.5.final)

io.undertow:undertow-core MAVEN version 1.3.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.gitblit.fathom:fathom-core 0.7.0 - com.gitblit.fathom:fathom-eventbus 0.7.0 -...