Vulnerabilities

TI-2023-27602 CVE-2023-50458 · GHSA-j6g3-hr9q-9xrq

In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs.

LOW 19

In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00218 Published 2025-07-10 Fixed in 4.11.0 CWE-1230

TI-2023-27716 CVE-2023-50786 · GHSA-2chh-r2hc-8q2g

Authentication bypass by capture-replay in dradisframework Dradis

MEDIUM 53

Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00276 Published 2025-07-05 No fix listed CWE-294

TI-2023-14929 CVE-2023-31223 · GHSA-9f3h-5jcm-xmgf

Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.

LOW 38

Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00509 Published 2023-04-25 No fix listed CWE-79

TI-2022-12354 CVE-2022-30028 · GHSA-wm94-f3wq-5x3f

Dradis Professional Edition before 4.3.0 allows attackers to change an account password…

LOW 27

Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00537 Published 2022-06-24 No fix listed CWE-362

TI-2019-14385 CVE-2019-19946 · GHSA-8pjr-7p6x-vj45

The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if…

LOW 31

The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the project team.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01187 Published 2020-03-16 No fix listed CWE-639

TI-2019-04221 CVE-2019-5925 · GHSA-q2fv-jr47-v347

Cross-site scripting in Security Roots Ltd Dradis Community Edition and Dradis…

LOW 26

Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Professional Edition v3.1.1 and earlier allow remote authenticated attackers to inject arbitrary web sc…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0082 Published 2019-03-12 No fix listed CWE-79

Vulnerabilities

Filters

In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs.

Authentication bypass by capture-replay in dradisframework Dradis

Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.

Dradis Professional Edition before 4.3.0 allows attackers to change an account password…

The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if…

Cross-site scripting in Security Roots Ltd Dradis Community Edition and Dradis…