Onenav

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Onenav records in CISA KEV

No Onenav vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

6 records in Onenav · all components

TI-2025-20713 CVE-2025-28096 · GHSA-9qpf-q9v6-4q5c

MEDIUM 58

OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00234 Published 2025-03-28 No fix listed CWE-918

TI-2023-06595 CVE-2023-7210 · GHSA-353q-7h99-hf4x

MEDIUM 50

A vulnerability was found in OneNav up to 0.9.33.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00984 Published 2024-01-07 No fix listed CWE-287

TI-2021-16282 CVE-2021-38712 · GHSA-jw9h-cfww-j6fj

LOW 35

OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01145 Published 2021-08-16 No fix listed CWE-668

TI-2025-20714 CVE-2025-28097 · GHSA-4r7f-8mqg-24xx

LOW 32

OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.0022 Published 2025-03-28 No fix listed CWE-79

TI-2021-15820 CVE-2021-38138 · GHSA-8mwf-jqf9-r8jg

LOW 28

OneNav beta 0.9.12 allows XSS via the Add Link feature.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01516 Published 2021-08-05 No fix listed CWE-79

TI-2022-09669 CVE-2022-26276 · GHSA-w3r8-7qq3-f5wq

LOW 26

An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01192 Published 2022-03-12 No fix listed CWE-22