FreshRSS kayıtları
freshrss üreticisine ait 22 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %50
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5
- CWE-284 Improper Access Control3
- CWE-352 Cross-Site Request Forgery (CSRF)2
- CWE-201 Insertion of Sensitive Information Into Sent Data1
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
22 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
39İzleyin | CVE-2025-54875İstismar yok | FreshRSS: Unauthorized creation of admin user when registration is enabledfreshrss · freshrss · CWE-284 | Kritik9,8 | — | %0,5 | 29 Eyl 2025 |
35İzleyin | CVE-2025-54592İstismar yok | FreshRSS has Incomplete Session Termination on Logoutfreshrss · freshrss · CWE-613 | Yüksek8,8 | — | %0,5 | 29 Eyl 2025 |
30İzleyin | CVE-2022-23497İstismar yok | Insecure file access in FreshRSSfreshrss · freshrss · CWE-200 | Yüksek7,5 | — | %0,9 | 9 Ara 2022 |
30İzleyin | CVE-2025-68148İstismar yok | FreshRSS globally denies access to feed via proxy modifying to 429 Retry-Afterfreshrss · freshrss · CWE-770 | Yüksek7,5 | — | %0,5 | 26 Ara 2025 |
30İzleyin | CVE-2025-54591İstismar yok | FreshRSS: Unauthenticated users can view default user's informationfreshrss · freshrss · CWE-284 | Yüksek7,5 | — | %0,4 | 29 Eyl 2025 |
30İzleyin | CVE-2025-62166İstismar yok | FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokensfreshrss · freshrss · CWE-284 | Yüksek7,5 | — | %0,4 | 9 Mar 2026 |
29İzleyin | CVE-2025-58173İstismar yok | FreshRSS vulnerable to authenticated RCE via path traversal inside include()freshrss · freshrss · CWE-20 | Yüksek7,4 | — | %0,7 | 15 Ara 2025 |
28İzleyin | CVE-2025-54593İstismar yok | FreshRSS is vulnerable to RCE attacks by authenticated adminfreshrss · freshrss · CWE-94 | Yüksek7,2 | — | %0,8 | 1 Ağu 2025 |
28İzleyin | CVE-2025-46341İstismar yok | Privilege escalation via SSRF when using HTTP authfreshrss · freshrss · CWE-918 | Yüksek7,1 | — | %0,5 | 4 Haz 2025 |
27İzleyin | CVE-2025-61586İstismar yok | FreshRSS is vulnerable to directory enumeration by setting path in its theme fieldfreshrss · freshrss · CWE-22 | Orta6,9 | — | %0,5 | 30 Eyl 2025 |
26İzleyin | CVE-2025-32015İstismar yok | FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>freshrss · freshrss · CWE-79 | Orta6,7 | — | %0,4 | 4 Haz 2025 |
26İzleyin | CVE-2025-59949İstismar yok | FreshRSS has Logout CSRF that Leads to DoS via <track src>freshrss · freshrss · CWE-352 | Orta6,5 | — | %0,4 | 18 Ara 2025 |
25İzleyin | CVE-2018-19782Kavram kanıtı | Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web scriptfreshrss · freshrss · CWE-79 | Orta6,1 | — | %4,4 | 30 Oca 2019 |
22İzleyin | CVE-2023-22481İstismar yok | Sensitive information exposure in the logs of greader API in FreshRSSfreshrss · freshrss · CWE-532 | Orta5,5 | — | %0,5 | 6 Mar 2023 |
22İzleyin | CVE-2025-31134İstismar yok | FreshRSS vulnerable to directory enumeration via ext.phpfreshrss · freshrss · CWE-201 | Orta5,5 | — | %0,5 | 4 Haz 2025 |
21İzleyin | CVE-2025-31136İstismar yok | FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entryfreshrss · freshrss · CWE-79 | Orta5,4 | — | %0,4 | 4 Haz 2025 |
21İzleyin | CVE-2025-59948İstismar yok | FreshRSS is vulnerable to XSS due to lack of CSP on HTML query pagefreshrss · freshrss · CWE-79 | Orta5,4 | — | %0,3 | 29 Eyl 2025 |
21İzleyin | CVE-2025-59950İstismar yok | FreshRSS: Double clickjacking can lead to privilege escalationfreshrss · freshrss · CWE-1021 | Orta5,4 | — | %0,3 | 30 Eyl 2025 |
21İzleyin | CVE-2025-57769İstismar yok | FressRSS: Clickjacking can lead to XSS and/or privilege escalationfreshrss · freshrss · CWE-79 | Orta5,3 | — | %0,3 | 29 Eyl 2025 |
17İzleyin | CVE-2025-31482İstismar yok | FreshRSS vulnerable to DoS by malicious feed entry loading logout URLfreshrss · freshrss · CWE-352 | Orta4,3 | — | %0,2 | 4 Haz 2025 |
17İzleyin | CVE-2025-46339İstismar yok | FreshRSS vulnerable to favicon cache poisoning via proxyfreshrss · freshrss · CWE-349 | Orta4,3 | — | %0,2 | 4 Haz 2025 |
11İzleyin | CVE-2025-68932İstismar yok | FreshRSS has weak cryptographic randomness in remember-me token and nonce generationfreshrss · freshrss · CWE-338 | Düşük2,9 | — | %0,6 | 26 Ara 2025 |
- CVE-2025-5487539İzleyin
FreshRSS: Unauthorized creation of admin user when registration is enabled
KritikCVSS 9,8İstismar yokEPSS %1freshrss · freshrss29 Eyl 2025
- CVE-2025-5459235İzleyin
FreshRSS has Incomplete Session Termination on Logout
YüksekCVSS 8,8İstismar yokEPSS %1freshrss · freshrss29 Eyl 2025
- CVE-2022-2349730İzleyin
Insecure file access in FreshRSS
YüksekCVSS 7,5İstismar yokEPSS %1freshrss · freshrss9 Ara 2022
- CVE-2025-6814830İzleyin
FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After
YüksekCVSS 7,5İstismar yokEPSS %0freshrss · freshrss26 Ara 2025
- CVE-2025-5459130İzleyin
FreshRSS: Unauthenticated users can view default user's information
YüksekCVSS 7,5İstismar yokEPSS %0freshrss · freshrss29 Eyl 2025
- CVE-2025-6216630İzleyin
FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
YüksekCVSS 7,5İstismar yokEPSS %0freshrss · freshrss9 Mar 2026
- CVE-2025-5817329İzleyin
FreshRSS vulnerable to authenticated RCE via path traversal inside include()
YüksekCVSS 7,4İstismar yokEPSS %1freshrss · freshrss15 Ara 2025
- CVE-2025-5459328İzleyin
FreshRSS is vulnerable to RCE attacks by authenticated admin
YüksekCVSS 7,2İstismar yokEPSS %1freshrss · freshrss1 Ağu 2025
- CVE-2025-4634128İzleyin
Privilege escalation via SSRF when using HTTP auth
YüksekCVSS 7,1İstismar yokEPSS %0freshrss · freshrss4 Haz 2025
- CVE-2025-6158627İzleyin
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
OrtaCVSS 6,9İstismar yokEPSS %0freshrss · freshrss30 Eyl 2025
- CVE-2025-3201526İzleyin
FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>
OrtaCVSS 6,7İstismar yokEPSS %0freshrss · freshrss4 Haz 2025
- CVE-2025-5994926İzleyin
FreshRSS has Logout CSRF that Leads to DoS via <track src>
OrtaCVSS 6,5İstismar yokEPSS %0freshrss · freshrss18 Ara 2025
- CVE-2018-1978225İzleyin
Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script
OrtaCVSS 6,1Kavram kanıtıEPSS %4freshrss · freshrss30 Oca 2019
- CVE-2023-2248122İzleyin
Sensitive information exposure in the logs of greader API in FreshRSS
OrtaCVSS 5,5İstismar yokEPSS %0freshrss · freshrss6 Mar 2023
- CVE-2025-3113422İzleyin
FreshRSS vulnerable to directory enumeration via ext.php
OrtaCVSS 5,5İstismar yokEPSS %0freshrss · freshrss4 Haz 2025
- CVE-2025-3113621İzleyin
FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entry
OrtaCVSS 5,4İstismar yokEPSS %0freshrss · freshrss4 Haz 2025
- CVE-2025-5994821İzleyin
FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page
OrtaCVSS 5,4İstismar yokEPSS %0freshrss · freshrss29 Eyl 2025
- CVE-2025-5995021İzleyin
FreshRSS: Double clickjacking can lead to privilege escalation
OrtaCVSS 5,4İstismar yokEPSS %0freshrss · freshrss30 Eyl 2025
- CVE-2025-5776921İzleyin
FressRSS: Clickjacking can lead to XSS and/or privilege escalation
OrtaCVSS 5,3İstismar yokEPSS %0freshrss · freshrss29 Eyl 2025
- CVE-2025-3148217İzleyin
FreshRSS vulnerable to DoS by malicious feed entry loading logout URL
OrtaCVSS 4,3İstismar yokEPSS %0freshrss · freshrss4 Haz 2025
- CVE-2025-4633917İzleyin
FreshRSS vulnerable to favicon cache poisoning via proxy
OrtaCVSS 4,3İstismar yokEPSS %0freshrss · freshrss4 Haz 2025
- CVE-2025-6893211İzleyin
FreshRSS has weak cryptographic randomness in remember-me token and nonce generation
DüşükCVSS 2,9İstismar yokEPSS %1freshrss · freshrss26 Ara 2025