15 matches found
CVE-2026-82838
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
CVE-2026-82838
Venueless 's default Docker image had a vulnerability where uploaded SVG files could be served with executable JavaScript content, potentially allowing stored XSS. The root cause was the absence of a proper Content Security Policy (CSP) in the image's default configuration. The fix sets a valid C...
EUVD-2026-68392
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
CVE-2026-82838 Default webserver configuration with incorrect CSP
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
CVE-2026-12863
An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains...
CVE-2026-12863
Venueless ’ social login contains an unvalidated redirect that could be exploited for phishing via trusted domains. Public records (NVD, CVE records) describe an unvalidated redirect in the social login flow, enabling attackers to lure users to attacker-controlled sites by leveraging trusted doma...
CVE-2026-12863 Open redirect
An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains...
EUVD-2026-38221
An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains...
CVE-2026-12863
An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains...
CVE-2026-5599
A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds...
CVE-2026-5599 API allows deletion of users of other instance
A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds...
EUVD-2026-19085
A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds...
CVE-2026-5599
CVE-2026-5599 affects the venueless platform: a user with API access and the "manage users" permission can trigger deletion of user accounts in other worlds. This cross-world impact can compromise account availability and integrity. The CVSS 4.0 base score is 7.3 (HIGH); attack vector is NETWORK ...
venueless 安全漏洞
Venueless is an open-source online activity platform developed by Venueless. There are security vulnerabilities in Venueless, stemming from improper permission management. These vulnerabilities could allow users with API access and the “Manage Users” permission to delete user accounts from other...
