CVE-2026-65710

SysPass 3.2.11 is affected by a missing authorization vulnerability in the PublicLink flow. Authenticated users with the PUBLICLINK_CREATE profile flag can trigger unauthorized decryption and persistence of vault passwords by abusing the absence of AccountAcl checks in the public link creation pa...

CVE-2017-1000192

Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, private encryption key, as well as other sensitive information...

CVE-2025-25478

The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password...