Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Ankitects Component: Anki Clear all filters
TI-2025-38505 CVE-2025-62187 · GHSA-cvrh-qggv-7gf8

Path traversal in Ankitects Anki

Priority LOW 15

In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00181 Published 2025-10-07 Fixed in 25.02.6 CWE-23
TI-2025-38503 CVE-2025-62185 · GHSA-j6hh-cgvw-j237

Uncontrolled search path in Ankitects Anki

Priority LOW 33

In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00155 Published 2025-10-07 Fixed in 25.02.5 CWE-427
TI-2024-21378 CVE-2024-32484 · GHSA-r6f4-5657-3fp7

Cross-site scripting in Ankitects Anki

Priority HIGH 69

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.2149 Published 2024-07-22 No fix listed CWE-80