Advisories · Technology
Erudika scoold.
Every CVE that names Erudika scoold among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.1 Medium
Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and Logs
- Erudika scoold
- Authentication bypass
- CVSS 5.4 Medium
Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass
- Erudika scoold
- Open redirect
- CVSS 5.4 Medium
Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain
- Erudika scoold
- CWE-346
- CWE-942
- CVSS 6.5 Medium
Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled
- Erudika scoold
- Broken access control
- CVSS 6.5 Medium
Scoold: Authenticated user can post replies and comments to private-space questions without space membership
- Erudika scoold
- Broken access control
- CVSS 6.7 Medium
Scoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation)
- Erudika scoold
- Authentication bypass
- CVSS 6.5 Medium
Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask
- Erudika scoold
- Broken access control
- CVSS 6.5 Medium
Scoold: Cross-Account Feedback Deletion (IDOR)
- Erudika scoold
- Broken access control
- CVSS 8.7 High
Semicolon Path Injection on API /api;/config
- Erudika scoold
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Improper handling of Length parameter in erudika/scoold
- erudika/scoold
- CWE-130