Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

18 records

Vendor: Hallo Welt! GmbH Clear all filters
TI-2026-79597 CVE-2026-25784 · GHSA-xrr7-cjx6-x9j2

Insecure default token auth in BlueSpice wiki enables sysop access

Priority MEDIUM 48

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00345 Published 2026-10-23 Fixed in 5.2.7 CWE-1188
TI-2026-79596 CVE-2026-25716 · GHSA-vr6v-xrj8-f9m9

Missing authorization in BlueSpiceUserManager lets users block accounts

Priority LOW 30

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administr…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00183 Published 2026-10-23 Fixed in 5.1.11, 5.2.7 CWE-862
TI-2026-19937 CVE-2026-24732 · GHSA-h5w8-m6jq-qmxf

Improper permission checks in Extension:NSFileRepo

Priority LOW 35

Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Pro…

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00308 Published 2026-03-04 No fix listed CWE-552
TI-2025-35941 CVE-2025-58114 · GHSA-x4vj-4rr5-pfhf

Potential XSS in Extension:CognitiveProcessDesigner

Priority LOW 26

Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects BlueSpice: from 5 through 5.1.1.

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.0018 Published 2025-09-19 No fix listed CWE-20
TI-2025-35734 CVE-2025-57880 · GHSA-47gw-9v4f-8f2g

Potential XSS in Extension:BlueSpiceWhoIsOnline

Priority LOW 26

Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS).

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00182 Published 2025-09-19 No fix listed CWE-116
TI-2025-30391 CVE-2025-48007 · GHSA-3p8r-f28v-66f3

Potential XSS in Extension:BlueSpiceAvatars

Priority LOW 26

Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS).

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00197 Published 2025-09-19 No fix listed CWE-116
TI-2025-29374 CVE-2025-46703 · GHSA-32cw-qm55-8qj6

Potential XSS in Extension:AtMentions

Priority LOW 26

Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS).

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00197 Published 2025-09-19 No fix listed CWE-116
TI-2023-22600 CVE-2023-42431 · GHSA-wh3j-5jfr-mvrv

Potential XSS on user preferences page

Priority LOW 25

Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00397 Published 2023-10-30 No fix listed CWE-20
TI-2022-20340 CVE-2022-42001 · GHSA-mh3f-7jrf-xp34

Potential XSS in book navigation

Priority LOW 24

Cross-site Scripting (XSS) vulnerability in BlueSpiceBookshelf extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the book navigation.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00274 Published 2022-11-15 Fixed in 4.2.1 CWE-79
TI-2022-20339 CVE-2022-42000 · GHSA-jwrw-2fh5-fg85

Potential XSS in comment section

Priority LOW 24

Cross-site Scripting (XSS) vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into the comment section of a wikipage.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00274 Published 2022-11-15 Fixed in 4.2.1 CWE-79
TI-2022-20182 CVE-2022-41814 · GHSA-pr8j-283m-jpf6

Potential XSS in history view

Priority LOW 24

Cross-site Scripting (XSS) vulnerability in BlueSpiceFoundation extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the history view of a wikipage.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00274 Published 2022-11-15 Fixed in 4.2.1 CWE-79
TI-2022-20164 CVE-2022-41789 · GHSA-fq8v-gxm4-m5gv

Potential XSS on default page header

Priority LOW 24

Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the default page header of a wikipage.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00274 Published 2022-11-15 Fixed in 4.2.1 CWE-79
TI-2022-20014 CVE-2022-41611 · GHSA-m2wg-p64c-9g45

Potential XSS on sidebar navigation

Priority LOW 22

Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00281 Published 2022-11-15 Fixed in 4.2.1 CWE-79
TI-2022-03627 CVE-2022-3958 · GHSA-hw93-9r88-26rp

Potential XSS on personal menu navigation

Priority LOW 24

Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and ot…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00274 Published 2022-11-15 Fixed in 4.2.1 CWE-79
TI-2022-03572 CVE-2022-3895

Potential XSS in common user interface component library

Priority LOW 27

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00291 Published 2022-11-15 Fixed in 3.0.5 CWE-79
TI-2022-03570 CVE-2022-3893 · GHSA-pggj-5r99-rf46

Potential XSS on custom menu navigation

Priority LOW 22

Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrary HTML into the custom menu navigation of the application.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00281 Published 2022-11-15 Fixed in 4.2.1 CWE-79
TI-2022-02319 CVE-2022-2510 · GHSA-px9p-4jmh-7m47

Potential XSS on Special:SearchCenter

Priority LOW 28

Cross-site Scripting (XSS) vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page "Special:SearchCenter", using the search term in the URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00467 Published 2022-07-22 Fixed in 4.1.1, 3.2.9 CWE-79
TI-2022-02320 CVE-2022-2511 · GHSA-m2qh-3fm2-xvmg

Potential XSS in title URL parameter

Priority LOW 28

Cross-site Scripting (XSS) vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of the call URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00467 Published 2022-07-22 Fixed in 4.1.3 CWE-79