Vulnerabilities

TI-2025-38819 CVE-2025-62604

MeterSphere logic flaw allows retrieval of arbitrary user information

LOW 24

MeterSphere is an open source continuous testing platform.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00424 Published 2025-10-22 Fixed in 2.10.25-lts CWE-200

TI-2025-33565 CVE-2025-53639

Metersphere has SQL Injection Vulnerability in Sorting Field

LOW 24

MeterSphere is an open source continuous testing platform.

CVSS 4.0MEDIUM 5.1 Network Low privileges No interaction EPSS 0.00428 Published 2025-07-14 Fixed in 3.6.5-lts CWE-89

TI-2024-24688 CVE-2024-37161

MeterSphere front-end editor stores XSS vulnerability

LOW 27

MeterSphere is an open source continuous testing platform.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00355 Published 2024-06-11 Fixed in 1.10.1-lts CWE-79

TI-2024-23948 CVE-2024-36118

Unauthorized viewing of workspace test cases in MeterSphere

LOW 20

MeterSphere is a test management and interface testing tool.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00296 Published 2024-05-30 No fix listed CWE-200

TI-2024-21362 CVE-2024-32467

Meteraphsere vulnerable to unauthorized viewing by workspace members

MEDIUM 62

MeterSphere is an open source continuous testing platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00532 Published 2024-04-25 Fixed in 2.10.14-lts CWE-200

TI-2023-27494 CVE-2023-50267

MeterSphere horizontal privilege escalation vulnerability of resources in project scope.

LOW 20

MeterSphere is a one-stop open source continuous testing platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00338 Published 2023-12-28 Fixed in 2.10.10-lts CWE-269

TI-2023-22271 CVE-2023-41878

Weak password of selenium VNC in MeterSphere

MEDIUM 43

MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00681 Published 2023-09-26 No fix listed CWE-798

TI-2023-19874 CVE-2023-38494

The cloud version of the MeterSphere interface leaks some sensitive data without authentication

HIGH 66

MeterSphere is an open-source continuous testing platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00471 Published 2023-08-04 Fixed in 2.10.4-LTS CWE-200

TI-2023-19070 CVE-2023-37461

Path traversal in metersphere

HIGH 75

Metersphere is an opensource testing framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00632 Published 2023-07-17 Fixed in 2.10.3 CWE-22

TI-2023-17998 CVE-2023-35937

Metersphere missing permission check

HIGH 71

Metersphere is an open source continuous testing platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00711 Published 2023-07-06 Fixed in 2.10.2-LTS CWE-862

TI-2023-15975 CVE-2023-32699

MeterSphere denial of service vulnerability

MEDIUM 62

MeterSphere is an open source continuous testing platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00587 Published 2023-05-30 Fixed in 2.10 CWE-770

TI-2023-14089 CVE-2023-29944 · GHSA-g88j-56qq-gwx6

Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution.

MEDIUM 53

Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02083 Published 2023-05-08 No fix listed CWE-78

TI-2023-14385 CVE-2023-30550

IDOR vulnerability exists in metersphere

LOW 31

MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.0067 Published 2023-05-04 Fixed in 2.9.0 CWE-639

TI-2023-11084 CVE-2023-25814

Arbitrary File Read Vulnerability in metersphere

LOW 33

metersphere is an open source continuous testing platform.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00858 Published 2023-03-09 Fixed in 2.7.1 CWE-22

TI-2023-10876 CVE-2023-25573

Improper access control to download file in metersphere

HIGH 75

metersphere is an open source continuous testing platform.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.51609 Published 2023-03-09 Fixed in 2.7.1 CWE-862

TI-2022-22822 CVE-2022-46178 · GHSA-9p62-x3c5-hr5p

Path Traversal In MeterSpere allows file upload to any path

HIGH 71

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00751 Published 2022-12-29 Fixed in v2.5.1, 2.5.1 CWE-22

TI-2022-07599 CVE-2022-23544

Server-Side Request Forgery in Metersphere leads to Cross-Site Scripting

HIGH 71

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.01717 Published 2022-12-27 Fixed in 2.5.0 CWE-79

TI-2022-07571 CVE-2022-23512

Metersphere is vulnerable to Path Injection.

HIGH 68

MeterSphere is a one-stop open source continuous testing platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00867 Published 2022-12-14 Fixed in 2.4.1 CWE-22

TI-2021-20841 CVE-2021-45790 · GHSA-8hj2-qp52-8qvm

An arbitrary file upload vulnerability was found in Metersphere v1.15.4.

MEDIUM 46

An arbitrary file upload vulnerability was found in Metersphere v1.15.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01936 Published 2021-12-27 No fix listed CWE-434

TI-2021-20840 CVE-2021-45789 · GHSA-hqvm-vcjf-63x9

An arbitrary file read vulnerability was found in Metersphere v1.15.4, where…

LOW 31

An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00921 Published 2021-12-27 No fix listed

TI-2021-20839 CVE-2021-45788 · GHSA-vv3r-w2j4-7q66

Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.

MEDIUM 44

Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03064 Published 2021-12-27 No fix listed CWE-89

Vulnerabilities

Filters