CVE-2025-50984

diskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws within its Elasticsearch configuration form. The root cause is improper input validation and parameterization during JSON-based query construction, allowing unsanitized user input in POST param...

CVE-2025-50986

diskover-web v2.3.0 Community Edition is vulnerable to multiple stored cross-site scripting (XSS) vulnerabilities within its administrative settings interface. The root cause is the failure to properly sanitize user-supplied input in several configuration fields, including ES_HOST , ES_INDEXREFRE...

CVE-2025-50985

diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws within its web interface. The vulnerability is caused by the improper neutralization of input, where unsanitized GET parameters —specifically maxage, maxindex, index, path, q (query), and do...