Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: steedos Clear all filters
TI-2026-75452 CVE-2026-111666 · GHSA-388m-pwcw-qwh5

Cross-tenant information disclosure in Steedos Platform reports API

Priority LOW 24

Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00269 Published 2026-10-16 No fix listed CWE-863
TI-2026-62058 CVE-2026-91922 · GHSA-925g-q5h8-6rmx

Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Priority MEDIUM 57

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00338 Published 2026-09-15 No fix listed CWE-79
TI-2020-18141 CVE-2020-35666 · GHSA-q7pj-xc3r-rm4w

Steedos Platform through 1.21.24 allows NoSQL injection because the…

Priority MEDIUM 40

Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos_base.js mishandles req.body validation, as demonstrated by MongoDB operator attacks su…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01086 Published 2020-12-23 No fix listed CWE-89