Priority LOW 20
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00451 · Published 2026-07-22 · Fixed in 6.3.5, 7.0.0 CWE-770
Priority LOW 26
elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00721 · Published 2021-12-24 · Fixed in 3.3.24 CWE-79
Priority LOW 36
elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01598 · Published 2021-12-03 · Fixed in 3.3.23, 4.0.5 CWE-359
Priority LOW 28
elgg is vulnerable to Authorization Bypass Through User-Controlled Key
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00805 · Published 2021-12-01 · Fixed in 3.3.22 CWE-639
Priority MEDIUM 45
Elgg through 1.7.10 has a SQL injection vulnerability
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01546 · Published 2019-11-12 · No fix listed CWE-89
Priority LOW 29
Elgg through 1.7.10 has XSS
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01057 · Published 2019-11-12 · Fixed in 1.7.11 CWE-79
Priority LOW 30
Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01188 · Published 2019-04-08 · Fixed in 1.12.18, 2.3.11 CWE-601
Priority LOW 23
Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to ac…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01457 · Published 2014-02-02 · No fix listed CWE-79
Priority LOW 23
engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01231 · Published 2013-05-23 · No fix listed CWE-264
Priority LOW 33
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts.
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.01338 · Published 2013-05-23 · No fix listed CWE-264
Priority LOW 22
Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01187 · Published 2013-05-23 · No fix listed CWE-79
Priority LOW 26
Elgg 1.7.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by vendors/simpletest/test/visual_test.php…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01335 · Published 2011-09-23 · No fix listed CWE-200
THREATIST.IORead the docs