Advisories · Technology

Hallo Welt! GmbH BlueSpice.

Every CVE that names Hallo Welt! GmbH BlueSpice among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-25784 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop
- Hallo Welt! GmbH BlueSpice
- Privilege escalation
- CWE-1188
Not analysed yet 23 Oct 2026
CVE-2026-25716 CVE record

CVSS 7.1 High

BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users
- Hallo Welt! GmbH BlueSpice
- Broken access control
Not analysed yet 23 Oct 2026
CVE-2026-24732 CVE record

CVSS 6.6 Medium

Improper permission checks in Extension:NSFileRepo
- Hallo Welt! GmbH BlueSpice
- Information disclosure
- Broken access control
Not analysed yet 4 Mar 2026
CVE-2025-58114 CVE record

CVSS 5.9 Medium

Potential XSS in Extension:CognitiveProcessDesigner
- Hallo Welt! GmbH BlueSpice
- CWE-20
Not analysed yet 19 Sept 2025
CVE-2025-57880 CVE record

CVSS 5.9 Medium

Potential XSS in Extension:BlueSpiceWhoIsOnline
- Hallo Welt! GmbH BlueSpice
- CWE-116
Not analysed yet 19 Sept 2025
CVE-2025-48007 CVE record

CVSS 5.9 Medium

Potential XSS in Extension:BlueSpiceAvatars
- Hallo Welt! GmbH BlueSpice
- CWE-116
Not analysed yet 19 Sept 2025
CVE-2025-46703 CVE record

CVSS 5.9 Medium

Potential XSS in Extension:AtMentions
- Hallo Welt! GmbH BlueSpice
- CWE-116
Not analysed yet 19 Sept 2025
CVE-2023-42431 CVE record

CVSS 2.1 Low

Potential XSS on user preferences page
- Hallo Welt! GmbH BlueSpice
- CWE-20
Not analysed yet 30 Oct 2023
CVE-2022-42001 CVE record

CVSS 3.3 Low

Potential XSS in book navigation
- Hallo Welt! GmbH BlueSpice
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2022
CVE-2022-42000 CVE record

CVSS 3.3 Low

Potential XSS in comment section
- Hallo Welt! GmbH BlueSpice
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2022
CVE-2022-41814 CVE record

CVSS 3.3 Low

Potential XSS in history view
- Hallo Welt! GmbH BlueSpice
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2022
CVE-2022-41789 CVE record

CVSS 3.3 Low

Potential XSS on default page header
- Hallo Welt! GmbH BlueSpice
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2022
CVE-2022-41611 CVE record

CVSS 2.3 Low

Potential XSS on sidebar navigation
- Hallo Welt! GmbH BlueSpice
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2022
CVE-2022-3958 CVE record

CVSS 3.3 Low

Potential XSS on personal menu navigation
- Hallo Welt! GmbH BlueSpice
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2022
CVE-2022-3893 CVE record

CVSS 2.3 Low

Potential XSS on custom menu navigation
- Hallo Welt! GmbH BlueSpice
- Cross-site scripting (XSS)
Not analysed yet 15 Nov 2022
CVE-2022-2510 CVE record

CVSS 4.3 Medium

Potential XSS on Special:SearchCenter
- Hallo Welt! GmbH BlueSpice
- Cross-site scripting (XSS)
Not analysed yet 22 Jul 2022
CVE-2022-2511 CVE record

CVSS 4.3 Medium

Potential XSS in title URL parameter
- Hallo Welt! GmbH BlueSpice
- Cross-site scripting (XSS)
Not analysed yet 22 Jul 2022