Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: chaskiq Clear all filters
TI-2026-75449 CVE-2026-111663 · GHSA-rggr-4j68-hc5w

Chaskiq SSRF via createUrlUpload GraphQL Mutation

Priority HIGH 79

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00374 Published 2026-10-16 No fix listed CWE-918
TI-2026-75448 CVE-2026-111662 · GHSA-938p-qgmw-f5v3

Chaskiq Unauthenticated SSRF via /oembed Endpoint

Priority HIGH 70

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0039 Published 2026-10-16 No fix listed CWE-918
TI-2026-50796 CVE-2026-72536 · GHSA-8wp4-ghqw-4g3h

Chaskiq Chaskiq - Missing Authentication

Priority MEDIUM 42

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00573 Published 2026-08-11 No fix listed CWE-306
TI-2026-50795 CVE-2026-72535 · GHSA-hqqc-4mgp-grm6

Chaskiq Chaskiq - Missing Authentication

Priority MEDIUM 42

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00573 Published 2026-08-11 No fix listed CWE-306
TI-2021-02788 CVE-2021-3857 · GHSA-c6rr-f65f-365x

Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq

Priority LOW 25

chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.006 Published 2022-01-17 No fix listed CWE-79
TI-2021-02784 CVE-2021-3853 · GHSA-5xxh-8vm7-3hmm

Cross-site Scripting (XSS) - Stored in chaskiq/chaskiq

Priority LOW 28

chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00616 Published 2022-01-17 Fixed in 0.9.8 CWE-79