Sync-in Server Security Vulnerabilities and Issues — Sync-in Server CVE List

Sync-inSync-in Server

3 matches found

CVE•added 2026/05/08 1:0 p.m.•22 views

CVE-2026-41161

Summary: CVE-2026-41161 affects Sync-in Server before version 2.2.0. The /api/auth/login endpoint exposes a timing-based flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring response times. This is confirmed in the GitHub advisory and CVE descriptions, which...

6.9CVSS5.8AI score0.00333EPSS

Web

CVE•added 2025/09/19 12:0 a.m.•21 views

CVE-2025-56869

CVE-2025-56869 describes a directory traversal vulnerability in the Sync In server (up to version 1.1.1). The issue affects the files-management code paths: FilesManager.saveMultipart and FilesManager.compress in backend/src/applications/files/services/files-manager.service.ts, enabling authentic...

5.3CVSS6.6AI score0.00691EPSS

CVE•added 2026/02/20 12:0 a.m.•13 views

CVE-2025-67438

CVE-2025-67438 affects Sync-in Server prior to 1.9.3. A stored XSS flaw allows an authenticated attacker to upload a crafted SVG file containing a malicious payload, enabling execution of arbitrary JavaScript in a victim’s browser and potential exfiltration of sensitive data, including session co...

6.1CVSS5.9AI score0.00267EPSS