Vulnerabilities

TI-2025-20637 CVE-2025-27913 · GHSA-28wr-h897-6hmv

Passbolt API before 5, if the server is misconfigured (with an incorrect installation…

LOW 16

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP H…

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00187 Published 2025-03-10 Fixed in 5 CWE-348

TI-2024-22254 CVE-2024-33670 · GHSA-2pg6-vw9c-qhjv

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom…

LOW 21

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00482 Published 2024-04-26 Fixed in 4.6.2 CWE-79

TI-2024-22253 CVE-2024-33669 · GHSA-xfq4-78j7-v594

An issue was discovered in Passbolt Browser Extension before 4.6.2.

MEDIUM 63

An issue was discovered in Passbolt Browser Extension before 4.6.2.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00643 Published 2024-04-26 Fixed in 4.6.2 CWE-200

TI-2017-14656 CVE-2017-1000442 · GHSA-j2fp-9wp5-mg66

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace

LOW 25

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00516 Published 2018-01-02 Fixed in 1.6.5 CWE-79

Vulnerabilities

Filters

Passbolt API before 5, if the server is misconfigured (with an incorrect installation…

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom…

An issue was discovered in Passbolt Browser Extension before 4.6.2.

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace