Chevereto

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Chevereto records in CISA KEV

No Chevereto vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Chevereto 5 records LOW

Records

7 records

TI-2026-85471 CVE-2026-122326 · GHSA-h8vc-h7q7-f23j

Authorization bypass in Chevereto exposes private album contents

HIGH 70

Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00522 Published 2026-11-05 Fixed in 4.5.8 CWE-639

TI-2026-39986 CVE-2026-55417

Chevereto private profile setting leaks username on /json endpoint

HIGH 70

Chevereto is a self-hosted media-sharing platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00421 Published 2026-07-07 Fixed in 4.5.4 CWE-862

TI-2021-11760 CVE-2021-31721 · GHSA-jxpj-gqq9-qj73

Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage.

LOW 29

Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00894 Published 2021-06-30 No fix listed CWE-79

TI-2012-02533 CVE-2012-2919 · GHSA-4x53-c6rv-jmrr

Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote…

LOW 29

Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote attackers to determine the existence of arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0325 Published 2012-05-21 No fix listed CWE-22

TI-2017-14397 CVE-2017-1000058 · GHSA-8pcq-p3m2-3v2h

Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user…

LOW 28

Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00726 Published 2017-07-13 No fix listed CWE-79

TI-2018-08623 CVE-2018-12030 · GHSA-8m2g-7w6w-g4h4

Chevereto Free before 1.0.13 has XSS.

LOW 25

Chevereto Free before 1.0.13 has XSS.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00654 Published 2018-06-15 No fix listed CWE-79

TI-2012-02532 CVE-2012-2918 · GHSA-x348-x493-xr7c

Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows…

LOW 23

Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbitrary web script or HTML via the v parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01605 Published 2012-05-21 No fix listed CWE-79

Open these records in search →

Critical	0
High	0
Medium	7
Low	0
No CVSS	0