Passbolt

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Passbolt records in CISA KEV

No Passbolt vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Passbolt Api 3 records LOW Passbolt Browser Extension 1 record MEDIUM

Records

3 records in Passbolt Api · all components

TI-2017-14656 CVE-2017-1000442 · GHSA-j2fp-9wp5-mg66

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace

LOW 25

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00516 Published 2018-01-02 Fixed in 1.6.5 CWE-79

TI-2024-22254 CVE-2024-33670 · GHSA-2pg6-vw9c-qhjv

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom…

LOW 21

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00482 Published 2024-04-26 Fixed in 4.6.2 CWE-79

TI-2025-20637 CVE-2025-27913 · GHSA-28wr-h897-6hmv

Passbolt API before 5, if the server is misconfigured (with an incorrect installation…

LOW 16

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP H…

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00187 Published 2025-03-10 Fixed in 5 CWE-348

Open these records in search →

Critical	0
High	0
Medium	3
Low	1
No CVSS	0