CVE-2023-0734

CVE-2023-0734 affects wallabag/wallabag prior to 2.5.4 due to an improper authorization issue in the GitHub repository. The vulnerability stems from inadequate access control in the affected code paths, enabling unauthorized behavior. Public sources consistently identify the affected version rang...

Stored Cross-site Scripting (XSS)

wallabag/wallabag is vulnerable to Stored Cross-site Scripting XSS. The vulnerability exists in share.html.twig due to lack of validations on HTML elements, which allows an attacker to inject and execute malicious JavaScript though the name field...

Cross-Site Request Forgery (CSRF)

wallabag/wallabag is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists due to a lack of validations in the account/delete functionality, which allows an attacker to delete a victims account after convincing a user to click a link...

wallabag licensing issue vulnerability (CNVD-2023-07920)

wallabag is a web application that allows you to save web pages for later reading. wallabag versions prior to 2.5.3 contain an authorization issue vulnerability that could be exploited by attackers to update other users' comments...

wallabag authorization issue vulnerability

wallabag is a web application that allows you to save web pages for later reading. wallabag versions prior to 2.5.3 contain an authorization issue vulnerability that stems from the fact that the exporting entry module is vulnerable to an IDOR attack, which could be exploited to view other users'...

GHSA-2QXP-XMX6-CQ4F Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...

GHSA-3X2C-87CQ-QX49 Cross-site Scripting (XSS) in wallabag/wallabag

Cross-site Scripting XSS - Stored in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-0735

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-0736

Cross-site Scripting XSS - Stored in GitHub repository wallabag/wallabag prior to 2.5.4...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-0735 Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...

wallabag 跨站请求伪造漏洞

wallabag is a web application that allows you to save web pages for later reading. A cross-site request forgery vulnerability exists in wallabag prior to version 2.5.4. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

CVE-2023-0735 Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...

wallabag 跨站脚本漏洞

wallabag is a web application that allows you to save web pages for later reading. A cross-site scripting vulnerability exists in wallabag prior to version 2.5.4. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

CVE-2023-0736 Cross-site Scripting (XSS) - Stored in wallabag/wallabag

Cross-site Scripting XSS - Stored in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-0735 Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-0736

Wallabag/wallabag contains a Stored XSS in versions prior to 2.5.4. The vulnerability stems from input in the shared page that can inject JavaScript; a Veracode entry notes attackers could inject and execute malicious JavaScript via the name field. No exploit details are provided beyond this. Rem...

CVE-2023-0735

CVE-2023-0735 is a CSRF vulnerability in wallabag/wallabag, present in versions prior to 2.5.4. Connected documents specify the root cause as a lack of validations in the account/delete functionality, enabling attacker‑initiated actions on behalf of an authenticated user. The sources consistently...

wallabag subject to Improper Authorization via annotations

Impact The annotations feature lets users add annotations on highlighted parts of an entry. The controller does not validate authorization on PUT and DELETE requests which lets a logged user modify or delete any annotation using their ID on their endpoints example.org/annotations/id. These...

GHSA-QWX8-MXXX-MG96 wallabag contains Improper Authorization via export feature

Description The export feature lets a user export a single entry or a set of entries in a given format e.g. PDF, MOBI, TXT. For example, https://yourinstance.wallabag.org/export/45.pdf will export the entry with id 45 in PDF format. Since wallabag 2.0.0-alpha.1, this feature is vulnerable to an...