CVE-2025-27913

The Passbolt API (versions prior to 5 ) is vulnerable to a Host Header Injection flaw (CWE-348) when the server is misconfigured. This occurs if the installation process is incorrect and Health Check results are disregarded, allowing an attacker to control the HTTP Host header . Consequently, the...

CVE-2024-33670

CVE-2024-33670 : Passbolt API before 4.6.2 allows HTML injection in a URL parameter; the underlying issue is HTML injection due to insufficient sanitization. This can cause custom content to be displayed when a user visits the crafted URL, though CSP prevents executing injected code. The impact i...

CVE-2017-1000442

CVE-2017-1000442 affects Passbolt API (version 1.6.4 and earlier) and is due to a cross-site scripting (XSS) vulnerability in the url field within the password workspace. The issue allows XSS via the URL input in the affected component; under CVSS3, the base score is 5.4 (MEDIUM) with network as ...