Vulnerabilities

TI-2025-20714 CVE-2025-28097 · GHSA-4r7f-8mqg-24xx

OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers.

LOW 32

OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.0022 Published 2025-03-28 No fix listed CWE-79

TI-2025-20713 CVE-2025-28096 · GHSA-9qpf-q9v6-4q5c

MEDIUM 58

OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00234 Published 2025-03-28 No fix listed CWE-918

TI-2023-06595 CVE-2023-7210 · GHSA-353q-7h99-hf4x

MEDIUM 50

A vulnerability was found in OneNav up to 0.9.33.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00984 Published 2024-01-07 No fix listed CWE-287

TI-2022-09669 CVE-2022-26276 · GHSA-w3r8-7qq3-f5wq

LOW 26

An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01192 Published 2022-03-12 No fix listed CWE-22

TI-2021-16282 CVE-2021-38712 · GHSA-jw9h-cfww-j6fj

LOW 35

OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01145 Published 2021-08-16 No fix listed CWE-668

TI-2021-15820 CVE-2021-38138 · GHSA-8mwf-jqf9-r8jg

LOW 28

OneNav beta 0.9.12 allows XSS via the Add Link feature.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01516 Published 2021-08-05 No fix listed CWE-79