Squidex

Records13All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Squidex records in CISA KEV

No Squidex vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Squidex 9 records HIGH

Records

13 records

TI-2026-19941 CVE-2026-24736

Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration

HIGH 74

Squidex is an open source headless content management system and content management hub.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00489 Published 2026-01-27 No fix listed CWE-918

TI-2023-24880 CVE-2023-46253

Remote code execution in Squidex

HIGH 74

Squidex is an open source headless CMS and content management hub.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01538 Published 2023-11-07 Fixed in 7.9.0 CWE-22

TI-2026-29795 CVE-2026-41172

Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)

HIGH 73

Squidex is an open source headless content management system and content management hub.

CVSS 4.0HIGH 7.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-04-22 Fixed in 7.23.0 CWE-918

TI-2026-29794 CVE-2026-41171

SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient

HIGH 73

Squidex is an open source headless content management system and content management hub.

CVSS 4.0HIGH 7.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-04-22 Fixed in 7.23.0 CWE-918

TI-2026-29793 CVE-2026-41170

Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests

HIGH 65

Squidex is an open source headless content management system and content management hub.

CVSS 4.0HIGH 7.2 Network High privileges No interaction EPSS 0.00238 Published 2026-04-22 Fixed in 7.23.0 CWE-918

TI-2023-00608 CVE-2023-0642 · GHSA-769x-rww2-6j8v

Cross-Site Request Forgery (CSRF) in squidex/squidex

MEDIUM 62

Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00412 Published 2023-02-02 Fixed in 7.4.0 CWE-352

TI-2023-00609 CVE-2023-0643 · GHSA-4g2g-8pcm-99w8

Improper Handling of Additional Special Element in squidex/squidex

MEDIUM 60

Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0058 Published 2023-02-02 Fixed in 7.4.0 CWE-167

TI-2026-29800 CVE-2026-41177

Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction

MEDIUM 58

Squidex is an open source headless content management system and content management hub.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00329 Published 2026-04-22 Fixed in 7.23.0 CWE-73

TI-2023-25227 CVE-2023-46744 · GHSA-g57h-gw9r-cw26

Stored Cross-site Scripting in Squidex

MEDIUM 58

Squidex is an open source headless CMS and content management hub.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00499 Published 2023-11-07 Fixed in 7.9.0 CWE-79

TI-2023-03342 CVE-2023-3580 · GHSA-p83x-2782-8pc4

Improper Handling of Additional Special Element in squidex/squidex

MEDIUM 53

Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00638 Published 2023-07-10 Fixed in 7.4.0 CWE-167

TI-2023-09957 CVE-2023-24278 · GHSA-xf98-7xfh-rcv5

Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.

LOW 33

Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02908 Published 2023-03-18 No fix listed CWE-79

TI-2023-24879 CVE-2023-46252

Cross-Site Scripting (XSS) via postMessage Handler in Squidex

LOW 31

Squidex is an open source headless CMS and content management hub.

CVSS 3.1MEDIUM 6.8 Adjacent network No auth User interaction EPSS 0.00473 Published 2023-11-07 Fixed in 7.9.0 CWE-79

TI-2023-25314 CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature.

LOW 25

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00569 Published 2023-12-07 No fix listed CWE-79

Open these records in search →

Critical	2
High	3
Medium	8
Low	0
No CVSS	0