Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: indico Component: Indico Clear all filters
TI-2026-22632 CVE-2026-28352 · GHSA-rfpp-2hgm-gp5v

Indico missing access check in event series management API

Priority LOW 35

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00299 Published 2026-02-27 Fixed in 3.3.11 CWE-306
TI-2026-20807 CVE-2026-25739 · GHSA-jxc4-54g3-j7vp

Indico affected by Cross-Site-Scripting via material uploads

Priority LOW 24

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00193 Published 2026-02-19 Fixed in 3.3.10 CWE-79
TI-2025-36677 CVE-2025-59035 · GHSA-7cf7-9wrr-vrf4

Indico vulnerable to Cross-Site Scripting via LaTeX math code

Priority LOW 24

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00206 Published 2025-09-10 Fixed in 3.3.8 CWE-79
TI-2025-33566 CVE-2025-53640 · GHSA-q28v-664f-q6wj

Indico vulnerable to user enumeration via API endpoint

Priority LOW 25

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00662 Published 2025-07-14 Fixed in 3.3.7 CWE-200
TI-2024-34052 CVE-2024-50633 · GHSA-3wg7-r7q5-r2jf

Authorization bypass in Indico

Priority HIGH 72

A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00635 Published 2025-01-16 Fixed in 3.3.3 CWE-201
TI-2024-30448 CVE-2024-45399 · GHSA-rrqf-w74j-24ff

Indico has a Cross-Site-Scripting during account creation

Priority LOW 27

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00383 Published 2024-09-04 Fixed in 3.3.4 CWE-1395
TI-2023-19334 CVE-2023-37901 · GHSA-fmqq-25x9-c6hm

Cross-Site-Scripting via confirmation prompts

Priority LOW 25

Indico is an open source a general-purpose, web based event management tool.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00516 Published 2023-07-21 Fixed in 3.2.6 CWE-79