Vulnerabilities in erudika
14 resultsCVE-2022-1543CRITICALImproper handling of Length parameter in erudika/scooldEPSS 1.1%CVE-2024-50334HIGHSemicolon Path Injection on API /api;/configEPSS 1.0%CVE-2022-1848CRITICALBusiness Logic Errors in erudika/paraEPSS 1.0%CVE-2022-1782CRITICALCross-site Scripting (XSS) - Generic in erudika/paraEPSS 1.0%CVE-2026-54676MEDIUMScoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabledEPSS 0.4%CVE-2026-54677MEDIUMScoold: Authenticated user can post replies and comments to private-space questions without space membershipEPSS 0.4%CVE-2026-34832MEDIUMScoold: Cross-Account Feedback Deletion (IDOR)EPSS 0.3%CVE-2026-42176MEDIUMScoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation)EPSS 0.3%CVE-2026-57183MEDIUMScoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and LogsEPSS 0.3%CVE-2026-55840MEDIUMScoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypassEPSS 0.3%CVE-2026-39354MEDIUMScoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/askEPSS 0.2%CVE-2025-48955MEDIUMPara Server Logs Sensitive InformationEPSS 0.2%CVE-2025-49009MEDIUMPara Inserts Sensitive Information into Log File for Facebook authenticationEPSS 0.2%CVE-2026-55842MEDIUMScoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domainEPSS 0.1%