Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

29 records

Vendor: indico Clear all filters
TI-2026-69692 CVE-2026-107397 · GHSA-cw24-x4mj-fw3q

Cross-site scripting in Indico minutes editor

Priority LOW 20

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.00233 Published 2026-10-08 Fixed in 3.3.13 CWE-79
TI-2026-69690 CVE-2026-107396 · GHSA-c4wc-ggrj-jg9v

Cross-site scripting in Indico link fields

Priority LOW 24

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00195 Published 2026-10-08 Fixed in 3.3.13 CWE-692
TI-2026-69686 CVE-2026-107395 · GHSA-6p4f-j8j6-463q

Missing access check in Indico legacy session export API

Priority LOW 20

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00235 Published 2026-10-08 Fixed in 3.3.13 CWE-862
TI-2026-69679 CVE-2026-107394 · GHSA-2v95-h47v-g4x9

Indico: Incomplete Server-Side Request Forgery (SSRF) check

Priority LOW 30

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00339 Published 2026-10-08 Fixed in 3.3.13 CWE-918
TI-2026-23225 CVE-2026-29080 · GHSA-vjr5-c9qv-hgm3

Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API

Priority MEDIUM 42

A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/searc…

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00281 Published 2026-05-06 Fixed in 35.8.5, 38.5.5 +2 CWE-89
TI-2026-22632 CVE-2026-28352 · GHSA-rfpp-2hgm-gp5v

Indico missing access check in event series management API

Priority LOW 35

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00299 Published 2026-02-27 Fixed in 3.3.11 CWE-306
TI-2026-20802 CVE-2026-25734 · GHSA-h9fp-p2p9-873q

Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Priority MEDIUM 62

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00338 Published 2026-02-25 Fixed in 35.8.3, 38.5.4 +1 CWE-1004
TI-2026-20300 CVE-2026-25138 · GHSA-38wq-6q2w-hcf9

Rucio WebUI has Username Enumeration via Login Error Message

Priority MEDIUM 63

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00375 Published 2026-02-25 Fixed in 35.8.3, 38.5.4 +1 CWE-204
TI-2026-20298 CVE-2026-25136 · GHSA-h79m-5jjm-jm4q

Rucio WebUI has a Reflected Cross-site Scripting Vulnerability

Priority HIGH 68

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0031 Published 2026-02-25 Fixed in 35.8.3, 38.5.4 +1 CWE-1004
TI-2026-20807 CVE-2026-25739 · GHSA-jxc4-54g3-j7vp

Indico affected by Cross-Site-Scripting via material uploads

Priority LOW 24

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00193 Published 2026-02-19 Fixed in 3.3.10 CWE-79
TI-2025-36677 CVE-2025-59035 · GHSA-7cf7-9wrr-vrf4

Indico vulnerable to Cross-Site Scripting via LaTeX math code

Priority LOW 24

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00206 Published 2025-09-10 Fixed in 3.3.8 CWE-79
TI-2025-33566 CVE-2025-53640 · GHSA-q28v-664f-q6wj

Indico vulnerable to user enumeration via API endpoint

Priority LOW 25

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00662 Published 2025-07-14 Fixed in 3.3.7 CWE-200
TI-2024-34052 CVE-2024-50633 · GHSA-3wg7-r7q5-r2jf

Authorization bypass in Indico

Priority HIGH 72

A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00635 Published 2025-01-16 Fixed in 3.3.3 CWE-201
TI-2024-30448 CVE-2024-45399 · GHSA-rrqf-w74j-24ff

Indico has a Cross-Site-Scripting during account creation

Priority LOW 27

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00383 Published 2024-09-04 Fixed in 3.3.4 CWE-1395
TI-2023-19334 CVE-2023-37901 · GHSA-fmqq-25x9-c6hm

Cross-Site-Scripting via confirmation prompts

Priority LOW 25

Indico is an open source a general-purpose, web based event management tool.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00516 Published 2023-07-21 Fixed in 3.2.6 CWE-79
Load more