CVE-2025-22963

CVE-2025-22963 affects Teedy up to version 1.11. The issue is a CSRF vulnerability that permits account takeover via POST /api/user/admin. Several connected sources confirm the affected software and the vulnerable endpoint, with Red Hat/Redundant feeds and PT-2025-4751 noting a workaround (restri...

CVE-2024-46278

Teedy version 1.11 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within its management console. The vulnerability occurs when downloading files, allowing an attacker to execute malicious scripts. If an administrator views a file uploaded by an attacker, the script can perform actions ...

CVE-2024-54851

Teedy versions 1.12 and earlier are vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of proper CSRF protection mechanisms. This flaw could allow an attacker to perform unauthorized actions on behalf of a user. As of the current reports, there is no information regarding a newer versi...

CVE-2022-22114

The CVE refers to Teedy, versions 1.5–1.9, with a Reflected Cross-Site Scripting (XSS) flaw in the search term display. The issue arises from insufficient sanitization/output of search results, enabling an attacker to craft a URL that injects scripts executed in the victim’s browser. In the descr...

CVE-2022-22115

The CVE-2022-22115 entry concerns Teedy (open-source document management). The vulnerability is a Stored XSS flaw in the name of a created Tag, caused by improper sanitization on the Edit Tag page. A low-privileged attacker can store malicious scripts in a Tag name, with potential impact to a hig...

CVE-2023-4892

CVE-2023-4892 affects Teedy v1.11, with a cross-site scripting (stored XSS) vulnerability in the text editor that lets attacker-supplied HTML/JS be executed in the web application. Impact stated: ability to run malicious JavaScript within the webapp. Exploitation details are not provided in the c...

CVE-2024-54852

Teedy versions 1.9 through 1.12 are vulnerable to LDAP injection when the LDAP connection is activated. The root cause is the improper sanitization of user input within the username field of the login form. An unauthenticated attacker can exploit this to perform malicious actions, including creat...

CVE-2025-11853

The CVE concerns Teedy (Sismics Teedy) up to 1.11, affecting the API’s /api/file endpoint. The root cause is improper access controls in the API Endpoint file, enabling a remote attacker to manipulate access. Public exploit discussion is noted, and the vulnerability is exploitable without user in...