Priority MEDIUM 41
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning N…
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00536 · Published 2026-11-05 · Fixed in 2.4.2 CWE-522
Priority LOW 24
Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00351 · Published 2023-03-08 · Fixed in 1.8.3 CWE-79
Priority MEDIUM 58
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00549 · Published 2023-03-02 · Fixed in 1.8.0 CWE-76
Priority MEDIUM 61
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.
CVSS 3.1MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00476 · Published 2023-02-17 · Fixed in 1.7.12 CWE-79
Priority MEDIUM 60
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00556 · Published 2023-02-13 · Fixed in 1.7.11 CWE-79
Priority MEDIUM 64
Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
CVSS 3.1MEDIUM 6.4· Network · High privileges · User interaction · EPSS 0.00607 · Published 2023-02-08 · Fixed in 1.7.6 CWE-601
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
CVSS 3.1MEDIUM 5.5· Network · Low privileges · User interaction · EPSS 0.00476 · Published 2023-02-08 · Fixed in 1.7.6 CWE-79
Priority MEDIUM 41
BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01017 · Published 2023-01-31 · No fix listed CWE-200
Priority HIGH 77
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.08118 · Published 2023-01-26 · Fixed in 1.7.5 CWE-76
Priority LOW 25
btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0056 · Published 2021-09-26 · Fixed in 1.2.3 CWE-79
Priority LOW 29
btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0077 · Published 2021-09-10 · Fixed in 1.2.3 CWE-79
Priority LOW 25
BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00527 · Published 2021-05-05 · No fix listed CWE-79
Priority LOW 26
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00823 · Published 2021-05-05 · No fix listed CWE-311
Priority LOW 26
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01201 · Published 2021-05-05 · No fix listed CWE-732
Priority LOW 33
BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.01548 · Published 2021-05-05 · No fix listed CWE-22
Priority LOW 26
BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00945 · Published 2021-05-05 · No fix listed CWE-338
Priority LOW 30
BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies).
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00786 · Published 2021-04-01 · No fix listed
Priority LOW 35
BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01189 · Published 2021-03-26 · No fix listed
THREATIST.IORead the docs