MarkUsProject records
8 published records for vendor markusproject.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 62.5%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-434 Unrestricted Upload of File with Dangerous Type2
- CWE-23 Relative Path Traversal1
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)1
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-639 Authorization Bypass Through User-Controlled Key1
- CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
8 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
36Monitor | CVE-2026-25057Proof of concept | Zip Slip in MarkUs config upload allowing RCEmarkusproject · markus · CWE-23 | Critical9.1 | — | 0.5% | Feb 9, 2026 |
28Monitor | CVE-2024-51743No exploit | Arbitrary File Write leading up to remote code execution (instructor accounts)markusproject · markus · CWE-434 | High7.1 | — | 0.7% | Nov 18, 2024 |
28Monitor | CVE-2024-51499No exploit | MarkUs Arbitrary File Write leading up to remote code execution (student accounts)markusproject · markus · CWE-434 | High7.1 | — | 0.7% | Nov 18, 2024 |
26Monitor | CVE-2026-25962No exploit | MarkUs: Zip bomb in config upload enables DoSmarkusproject · markus · CWE-409 | Medium6.5 | — | 0.4% | Mar 6, 2026 |
26Monitor | CVE-2026-24900No exploit | MarkUs has a submission-view IDOR exposes all student submissionsmarkusproject · markus · CWE-639 | Medium6.5 | — | 0.3% | Feb 9, 2026 |
21Monitor | CVE-2026-28405No exploit | MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actionsmarkusproject · markus · CWE-79 | Medium5.4 | — | 0.4% | Mar 5, 2026 |
19Monitor | CVE-2026-27807No exploit | MarkUs: YAML alias (‘billion laughs’) DoS in config uploadmarkusproject · markus · CWE-776 | Medium4.9 | — | 0.5% | Mar 6, 2026 |
14Monitor | CVE-2024-47820No exploit | MarkUs vulnerable to Path Traversalmarkusproject · markus · CWE-22 | Low3.5 | — | 0.7% | Nov 18, 2024 |
- CVE-2026-2505736Monitor
Zip Slip in MarkUs config upload allowing RCE
CriticalCVSS 9.1Proof of conceptEPSS 0%markusproject · markusFeb 9, 2026
- CVE-2024-5174328Monitor
Arbitrary File Write leading up to remote code execution (instructor accounts)
HighCVSS 7.1No exploitEPSS 1%markusproject · markusNov 18, 2024
- CVE-2024-5149928Monitor
MarkUs Arbitrary File Write leading up to remote code execution (student accounts)
HighCVSS 7.1No exploitEPSS 1%markusproject · markusNov 18, 2024
- CVE-2026-2596226Monitor
MarkUs: Zip bomb in config upload enables DoS
MediumCVSS 6.5No exploitEPSS 0%markusproject · markusMar 6, 2026
- CVE-2026-2490026Monitor
MarkUs has a submission-view IDOR exposes all student submissions
MediumCVSS 6.5No exploitEPSS 0%markusproject · markusFeb 9, 2026
- CVE-2026-2840521Monitor
MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions
MediumCVSS 5.4No exploitEPSS 0%markusproject · markusMar 5, 2026
- CVE-2026-2780719Monitor
MarkUs: YAML alias (‘billion laughs’) DoS in config upload
MediumCVSS 4.9No exploitEPSS 0%markusproject · markusMar 6, 2026
- CVE-2024-4782014Monitor
MarkUs vulnerable to Path Traversal
LowCVSS 3.5No exploitEPSS 1%markusproject · markusNov 18, 2024