Advisories · Technology
etherpad.
Every CVE that names etherpad among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.6 CriticalCritical · CVSS 9+
Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
- etherpad
- Cross-site scripting (XSS)
- CVSS 9.9 CriticalCritical · CVSS 9+
Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
- etherpad
- Broken access control