Advisories · Technology
papra.
Every CVE that names papra among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request
- papra
- Broken access control
- CVSS 4.3 Medium
Papra Does Not Reject Expired API Keys
- papra
- Authentication bypass
- CVSS 5.0 Medium
Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL
- papra
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name
- papra
- Cross-site scripting (XSS)