btcpayserver

Records18All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

btcpayserver records in CISA KEV

No btcpayserver vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Btcpay Server 13 records HIGH Btcpayserver 4 records MEDIUM

Records

18 records

TI-2023-00467 CVE-2023-0493

Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver

HIGH 77

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.08118 Published 2023-01-26 Fixed in 1.7.5 CWE-76

TI-2023-00710 CVE-2023-0748 · GHSA-jvf7-qpqh-8mxh

Open Redirect in btcpayserver/btcpayserver

MEDIUM 64

Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.

CVSS 3.1MEDIUM 6.4 Network High privileges User interaction EPSS 0.00607 Published 2023-02-08 Fixed in 1.7.6 CWE-601

TI-2023-00834 CVE-2023-0879 · GHSA-wh8v-v378-r87r

Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

MEDIUM 61

Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00476 Published 2023-02-17 Fixed in 1.7.12 CWE-79

TI-2023-00768 CVE-2023-0810 · GHSA-f3fc-w342-3j5r

Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

MEDIUM 60

Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00556 Published 2023-02-13 Fixed in 1.7.11 CWE-79

TI-2023-01087 CVE-2023-1149 · GHSA-h5wq-xq9g-pppc

Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver

MEDIUM 58

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00549 Published 2023-03-02 Fixed in 1.8.0 CWE-76

TI-2023-00709 CVE-2023-0747 · GHSA-rv9f-m2m8-w4mm

Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00476 Published 2023-02-08 Fixed in 1.7.6 CWE-79

TI-2026-85685 CVE-2026-119757 · GHSA-87gv-mpgp-xpp2

Information disclosure in BTCPay Server exposes LND macaroon files

MEDIUM 41

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning N…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00536 Published 2026-11-05 Fixed in 2.4.2 CWE-522

TI-2022-14495 CVE-2022-32984 · GHSA-mpjh-c64m-g538

BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive…

MEDIUM 41

BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01017 Published 2023-01-31 No fix listed CWE-200

TI-2021-10062 CVE-2021-29249 · GHSA-xgwm-rhgp-jr5w

BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.

LOW 35

BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01189 Published 2021-03-26 No fix listed

TI-2021-10059 CVE-2021-29246 · GHSA-6w4p-96gh-fgfp

BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker…

LOW 33

BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.01548 Published 2021-05-05 No fix listed CWE-22

TI-2021-10064 CVE-2021-29251 · GHSA-8qq9-8h7f-8qvp

BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register…

LOW 30

BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00786 Published 2021-04-01 No fix listed

TI-2021-02591 CVE-2021-3646 · GHSA-p4ww-48c6-98q5

Cross-site Scripting (XSS) - Reflected in btcpayserver/btcpayserver

LOW 29

btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0077 Published 2021-09-10 Fixed in 1.2.3 CWE-79

TI-2021-10061 CVE-2021-29248 · GHSA-gxgq-96mg-778q

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive…

LOW 26

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00823 Published 2021-05-05 No fix listed CWE-311

TI-2021-10060 CVE-2021-29247 · GHSA-9f24-x4vj-q8g2

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive…

LOW 26

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01201 Published 2021-05-05 No fix listed CWE-732

TI-2021-10058 CVE-2021-29245 · GHSA-6p4w-gcxh-hf6c

BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key.

LOW 26

BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00945 Published 2021-05-05 No fix listed CWE-338

TI-2021-10063 CVE-2021-29250 · GHSA-28x9-v6gq-r37m

BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS)…

LOW 25

BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00527 Published 2021-05-05 No fix listed CWE-79

TI-2021-02761 CVE-2021-3830 · GHSA-3xmg-w8wr-4536

Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

LOW 25

btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0056 Published 2021-09-26 Fixed in 1.2.3 CWE-79

TI-2023-01201 CVE-2023-1270 · GHSA-xfm4-w623-4vcg

Cross-site Scripting in btcpayserver/btcpayserver

LOW 24

Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00351 Published 2023-03-08 Fixed in 1.8.3 CWE-79

Open these records in search →