CVE-2025-50984

Diskover-web v2.3.0 Community Edition is affected by multiple boolean-based blind SQL injection flaws in the Elasticsearch configuration form. Untrusted input in POST fields (e.g., ES_PASS, ES_MAXSIZE, ES_TRANSLOGSIZE, ES_TIMEOUT, ES_USER, ES_HOST, ES_PORT, ES_SCROLLSIZE, ES_CHUNKSIZE) can inject...

CVE-2025-50986

Diskover-web v2.3.0 Community Edition is affected by multiple stored XSS vulnerabilities in the administrative settings interface. The root cause is improper sanitization of user input in configuration fields (ES_HOST, ES_INDEXREFRESH, ES_PORT, ES_SCROLLSIZE, ES_TRANSLOGSIZE, ES_TRANSLOGSYNCINT, ...

CVE-2025-50985

CVE-2025-50985 affects diskover-web v2.3.0 Community Edition. The vulnerability is described as multiple reflected cross-site scripting (XSS) flaws in the web interface caused by unsanitized GET parameters (including maxage, maxindex, index, path, q, and doctype) that are echoed into the HTML res...