CVE-2023-39846

CVE-2023-39846 affects Konga v0.14.9 and enables authentication bypass via a crafted JWT token. The CVSSv3.1 base score is 9.8 (CRITICAL) with Network attack vector, low complexity, and no privileges/user interaction required. Documented impact is total compromise of confidentiality, integrity, a...

CVE-2024-34243

The Konga application (specifically version v0.14.9 ) is vulnerable to Cross-Site Scripting (XSS) due to inadequate input validation on the username parameter. This flaw allows an attacker to inject malicious scripts into the application, which can be executed in the context of a user's browser. ...