CVE-2023-0643

CVE-2023-0643 affects squidex/squidex prior to 7.4.0. The issue is described as improper handling of an additional special element in the GitHub repository, enabling potential HTML injection in activity-related contexts (as per CNNVD/Red Hat/NVD family entries). The vulnerability impact is framed...

CVE-2023-24278

Squidex before 7.4.0 has a cross-site scripting (XSS) vulnerability via the squid.svg endpoint. The issue arises from unsanitized input in the SVG generated by the endpoint, enabling an attacker to potentially obtain sensitive information, modify data, or perform unauthorized admin operations in ...

CVE-2023-46252

Squidex (open-source headless CMS) contains an XSS vulnerability in a postMessage handler due to missing origin verification. The editor-sdk.js defines classes (SquidexSidebar, SquidexWidget, SquidexFormField) that use a global message listener; when a message of type valueChanged is received, th...

CVE-2023-0642

CVE-2023-0642 affects squidex/squidex prior to version 7.4.0 and is a Cross-Site Request Forgery (CSRF) vulnerability. The root cause, as described in connected sources, is a lack of proper CSRF token verification, allowing an attacker to induce authenticated users to perform unintended actions. ...

CVE-2023-3580

The CVE-2023-3580 entry concerns the Squidex project (squidex/squidex) prior to version 7.4.0. The underlying issue is described as improper handling of an additional special element in the repository, leading to a MEDIUM impact vulnerability (per NVD/SECURITY METRICS). Affected component is the ...

CVE-2026-24736

Squidex (up to 7.21.0) is vulnerable to a Server-Side Request Forgery (SSRF) in the Webhook configuration. The url parameter used by Rules engine webhooks does not validate destination IPs, allowing local addresses (e.g., 127.0.0.1, localhost). When a rule triggers, the backend makes an HTTP requ...

CVE-2023-46744

CVE-2023-46744 concerns a stored XSS in Squidex via SVG asset uploads. The vulnerability arises because the SVG filtering logic (which blocks [removed] and on* attributes) can be bypassed by using elements like with a javascript: URL, allowing an authenticated attacker (with assets.create permis...

CVE-2023-46253

Squidex vulnerability CVE-2023-46253 affects the open source headless CMS Squidex, where the backup restore feature can be abused by an authenticated user with squidex.admin.restore permission to write files and cause remote code execution (RCE). The root cause is that during asset restoration, t...

CVE-2023-46857

Squidex Headless CMS is affected: versions before 7.9.0 suffer an XSS via an SVG document in the Upload Assets feature due to an incomplete blacklist in the SVG inspection. The attack requires the attacker to have assets.create permission and is possible through the SRC attribute of an IFRAME in ...