CVE-2026-55085 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...

CVE-2026-55085

Etherpad (real-time collaborative editor) is affected by a stored cross-site scripting vulnerability prior to version 3.3.1 . The root cause is in result.appendSpan in src/static/js/domline.ts, which interpolates the start attribute of a numbered list directly into an unquoted ol start attribute ...

CVE-2026-55085 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...

EUVD-2019-8010

Malware in sbrugna...

EUVD-2013-7147

Malware in sbrugna...

EUVD-2018-18581

Malware in sbrugna...

EUVD-2022-4627

Malicious code in bioql PyPI...

CVE-2019-18209

templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...

CVE-2013-7380

The Etherpad Lite epimageconvert Plugin has a Remote Command Injection Vulnerability...

SUSE CVE-2013-7380

The Etherpad Lite epimageconvert Plugin has a Remote Command Injection Vulnerability...

SUSE CVE-2018-6835

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

SUSE CVE-2018-6834

static/js/padutils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href...

SUSE CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access...

GHSA-MVMV-RQ2J-97P2 Etherpad Lite Access Restriction Bypass

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

Etherpad Lite Access Restriction Bypass

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

Privilege Escalation

github.com/ether/etherpad-lite is vulnerable to Privilege Escalation. The library does not properly validate the .etherpad import files, allowing an attacker to gain admin privileges and execute arbitrary code using malicious crafted import file...

Unspecified Vulnerability in Etherpad-Lite

Etherpad-Lite is a Web-based open source document editor from the Etherpad Foundation. A security vulnerability exists in Etherpad-Lite versions prior to 1.8.3 that stems from the effects of a missing lock check and can be exploited by an attacker to cause a denial of service...

Unspecified Vulnerability in Etherpad-Lite (CNVD-2021-39572)

Etherpad-Lite is a Web-based open source document editor from the Etherpad Foundation. A security vulnerability exists in Etherpad-Lite versions prior to 1.8.3, which can be exploited by attackers to cause a denial of service...

Etherpad-Lite 安全漏洞

Etherpad-Lite is a Web-based open source document editor from the Etherpad Foundation. A security vulnerability exists in Etherpad-Lite versions prior to 1.8.3 that stems from the effects of a missing lock check and can be exploited by an attacker to cause a denial of service...

Etherpad SQL注入漏洞

Etherpad-Lite is a web-based open source document editor from the Etherpad Foundation. A security vulnerability exists in Etherpad versions prior to 1.8.3, which stems from a specially designed URI that raises an unhandled exception in the caching mechanism and results in a denial of service...