Advisories · Technology
FreshRSS.
Every CVE that names FreshRSS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]
- FreshRSS
- Authentication bypass
- CVSS 7.5 High
FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
- FreshRSS
- Broken access control
- CVSS 4.3 Medium
FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After
- FreshRSS
- Denial of service
- CVSS 2.9 Low
FreshRSS has weak cryptographic randomness in remember-me token and nonce generation
- FreshRSS
- Weak cryptography or TLS
- CVSS 5.3 Medium
FreshRSS has Logout CSRF that Leads to DoS via <track src>
- FreshRSS
- Cross-site request forgery (CSRF)
- CVSS 7.4 High
FreshRSS vulnerable to authenticated RCE via path traversal inside include()
- FreshRSS
- Path traversal
- CWE-20
- CVSS 6.7 Medium
FreshRSS: Double clickjacking can lead to privilege escalation
- FreshRSS
- CWE-1021
- CVSS 6.9 Medium
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
- FreshRSS
- Path traversal
- CVSS 6.7 Medium
FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page
- FreshRSS
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
FressRSS: Clickjacking can lead to XSS and/or privilege escalation
- FreshRSS
- Cross-site scripting (XSS)
- CWE-1021
- CVSS 9.8 CriticalCritical · CVSS 9+
FreshRSS: Unauthorized creation of admin user when registration is enabled
- FreshRSS
- Broken access control
- CVSS 8.8 High
FreshRSS has Incomplete Session Termination on Logout
- FreshRSS
- Authentication bypass
- CVSS 7.5 High
FreshRSS: Unauthenticated users can view default user's information
- FreshRSS
- Broken access control
- CVSS 7.2 High
FreshRSS is vulnerable to RCE attacks by authenticated admin
- FreshRSS
- Code injection
- CVSS 7.1 High
Privilege escalation via SSRF when using HTTP auth
- FreshRSS
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
FreshRSS vulnerable to favicon cache poisoning via proxy
- FreshRSS
- CWE-349
- CVSS 6.7 Medium
FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>
- FreshRSS
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
FreshRSS vulnerable to DoS by malicious feed entry loading logout URL
- FreshRSS
- Cross-site request forgery (CSRF)
- CVSS 6.7 Medium
FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entry
- FreshRSS
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
FreshRSS vulnerable to directory enumeration via ext.php
- FreshRSS
- Information disclosure
- CVSS 4.0 Medium
Sensitive information exposure in the logs of greader API in FreshRSS
- FreshRSS
- Information disclosure
- CVSS 6.5 Medium
Insecure file access in FreshRSS
- FreshRSS
- Information disclosure