Advisories · Technology
hoppscotch.
Every CVE that names hoppscotch among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.6 High
Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
- hoppscotch
- Information disclosure
- Broken access control
- CVSS 7.5 High
Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server
- hoppscotch
- Information disclosure
- Broken access control
- CVSS 7.2 High
Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection
- hoppscotch
- Command injection
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
- hoppscotch
- Broken access control
- CVSS 7.5 High
hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token
- hoppscotch
- Broken access control
- Authentication bypass
- CVSS 8.5 High
hoppscotch: Improper loopback redirect_uri validation in device-login flow
- hoppscotch
- Open redirect
- CVSS 5.4 Medium
hoppscotch: Stored XSS in team member overflow tooltip via display name
- hoppscotch
- Cross-site scripting (XSS)
- CVSS 8.5 High
hoppscotch: Stored XSS via mock server responses on backend origin
- hoppscotch
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
hoppscotch: Open redirect via `/enter?redirect=`
- hoppscotch
- Open redirect
- CVSS 0.0 None
hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token
- hoppscotch
- Broken access control
- CVSS 6.5 Medium
IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections
- hoppscotch
- Broken access control
- CVSS 8.3 High
hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment
- hoppscotch
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover
- hoppscotch
- Broken access control
- Authentication bypass
- CVSS 5.4 Medium
Content spoofing - real Hoppscotch emails
- hoppscotch
- Cross-site scripting (XSS)
- CWE-20
- CVSS 7.8 High
Database password exposed in logs in hoppscotch
- hoppscotch
- Information disclosure