Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

13 records

Vendor: wallabag Clear all filters
TI-2026-73444 CVE-2026-110228 · GHSA-rqqm-gvvm-8vpc

Stored cross-site scripting in wallabag via failed HTML import upload

Priority MEDIUM 56

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00274 Published 2026-10-13 No fix listed CWE-79
TI-2026-56646 CVE-2026-82089 · GHSA-c6wm-f83x-r49p

Cross-site scripting in wallabag android-app

Priority MEDIUM 41

The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.

CVSS 4.0HIGH 8.8 Network Low privileges User interaction EPSS 0.00525 Published 2026-08-28 No fix listed CWE-79
TI-2023-00699 CVE-2023-0737 · GHSA-99w8-c5f6-96pp

CSRF in wallabag/wallabag

Priority MEDIUM 62

wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00325 Published 2024-11-15 Fixed in 2.5.4 CWE-352
TI-2023-04113 CVE-2023-4455 · GHSA-gjvc-55fw-v6vq

Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Priority MEDIUM 62

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00321 Published 2023-08-21 Fixed in 2.6.3 CWE-352
TI-2023-04112 CVE-2023-4454 · GHSA-p8gp-899c-jvq9

Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Priority MEDIUM 59

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00268 Published 2023-08-21 Fixed in 2.6.3 CWE-352
TI-2023-00696 CVE-2023-0734 · GHSA-8ccw-f83g-v7g3

Improper Authorization in wallabag/wallabag

Priority MEDIUM 63

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00498 Published 2023-03-05 Fixed in 2.5.4 CWE-285
TI-2023-00698 CVE-2023-0736 · GHSA-3x2c-87cq-qx49

Cross-site Scripting (XSS) - Stored in wallabag/wallabag

Priority MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00443 Published 2023-02-07 Fixed in 2.5.4 CWE-79
TI-2023-00577 CVE-2023-0610 · GHSA-mrqx-mjc4-vfh3

Improper Authorization in wallabag/wallabag

Priority MEDIUM 53

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00444 Published 2023-02-01 Fixed in 2.5.3 CWE-285
TI-2023-00576 CVE-2023-0609 · GHSA-qwx8-mxxx-mg96

Improper Authorization in wallabag/wallabag

Priority MEDIUM 53

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00637 Published 2023-02-01 Fixed in 2.5.3 CWE-285