CVE-2023-35154: high-severity vulnerability in KnowageLabs Knowage-Server
Knowage-Server vulnerable to account validation bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.4%
Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activate their account without having to click on the link included in the email, allowing them access to the application as a normal user. This issue has been patched in version 8.1.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
KnowageLabs · Knowage-ServerRelated CVEs — KnowageLabs Knowage-Server
In the same product, most dangerous first.
CVE-2023-38702CRITICALKnowage Server vulnerable to path traversal via upload functionalityEPSS 1.2%CVE-2023-36819MEDIUMKnowage-Server vulnerable to Path traversal in download functionalitiesEPSS 0.8%CVE-2022-39295MEDIUMImproper Neutralization of Alternate XSS Syntax in Knowage-ServerEPSS 0.7%CVE-2023-37472HIGHQuery injection in Knowage serverEPSS 0.7%CVE-2025-59954CRITICALKnowage Contains a Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-55007LOWKnowage vulnerable to server-side request forgeryEPSS 0.2%