bookstackapp records

22 published records for vendor bookstackapp.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 50%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

22 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
47Plan	CVE-2021-4119No exploit	Improper Access Control in bookstackapp/bookstackbookstackapp · bookstack · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	26.9%	Dec 15, 2021
36Monitor	CVE-2020-5256No exploit	Remote Code Execution Through Image Uploads in BookStackbookstackapp · bookstack · CWE-95 RCE	High8.8	—	2.0%	Mar 9, 2020
34Monitor	CVE-2020-26210No exploit	Cross-Site Scripting in BookStackbookstackapp · bookstack · CWE-79 XSS	High8.7	—	1.2%	Nov 3, 2020
34Monitor	CVE-2020-26211No exploit	Cross-Site Scripting in BookStackbookstackapp · bookstack · CWE-79 XSS	High8.7	—	1.1%	Nov 3, 2020
30Monitor	CVE-2024-36676No exploit	Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification emCWE-79 Pre-auth XSS Denial of service	High7.5	—	0.6%	Jul 9, 2024
27Monitor	CVE-2021-3944No exploit	Cross-Site Request Forgery (CSRF) in bookstackapp/bookstackbookstackapp · bookstack · CWE-352 Pre-auth CSRF	Medium6.8	—	0.6%	Dec 2, 2021
26Monitor	CVE-2023-6199Proof of concept	Book Stack v23.10.2 - LFR via Blind SSRFbookstackapp · bookstack · CWE-918 SSRF	Medium6.5	—	1.4%	Nov 20, 2023
26Monitor	CVE-2021-3916No exploit	Path Traversal in bookstackapp/bookstackbookstackapp · bookstack · CWE-22 Path traversal	Medium6.5	—	1.2%	Nov 5, 2021
26Monitor	CVE-2021-3874No exploit	Path Traversal in bookstackapp/bookstackbookstackapp · bookstack · CWE-22 Path traversal	Medium6.5	—	1.2%	Oct 15, 2021
26Monitor	CVE-2021-3758No exploit	Server-Side Request Forgery (SSRF) in bookstackapp/bookstackbookstackapp · bookstack · CWE-918 SSRF	Medium6.5	—	0.8%	Sep 2, 2021
26Monitor	CVE-2021-4194No exploit	Improper Access Control in bookstackapp/bookstackbookstackapp · bookstack · CWE-284 Broken access control (IDOR)	Medium6.5	—	0.7%	Jan 6, 2022
26Monitor	CVE-2021-3906No exploit	Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstackbookstackapp · bookstack · CWE-434 File upload	Medium6.5	—	0.7%	Oct 27, 2021
25Monitor	CVE-2020-26260No exploit	Server Side Request Forgery in BookStackbookstackapp · bookstack · CWE-74	Medium6.4	—	0.8%	Dec 9, 2020
22Monitor	CVE-2021-3915No exploit	Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstackbookstackapp · bookstack · CWE-434 File upload	Medium5.7	—	1.0%	Nov 13, 2021
21Monitor	CVE-2022-0877No exploit	Cross-site Scripting (XSS) - Stored in bookstackapp/bookstackbookstackapp · bookstack · CWE-79 XSS	Medium5.4	—	0.8%	Mar 8, 2022
21Monitor	CVE-2020-11055No exploit	Cross-site Scripting in BookStackbookstackapp · bookstack · CWE-79 XSS	Medium5.4	—	0.8%	May 7, 2020
21Monitor	CVE-2022-40690No exploit	Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary scripbookstackapp · bookstack · CWE-79 XSS	Medium5.4	—	0.8%	Oct 24, 2022
21Monitor	CVE-2017-1000462No exploit	BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of servbookstackapp · bookstack · CWE-79 XSS	Medium5.4	—	0.8%	Jan 3, 2018
21Monitor	CVE-2021-3768No exploit	Cross-site Scripting (XSS) - Stored in bookstackapp/bookstackbookstackapp · bookstack · CWE-79 XSS	Medium5.4	—	0.6%	Sep 6, 2021
21Monitor	CVE-2021-3767No exploit	Cross-site Scripting (XSS) - Stored in bookstackapp/bookstackbookstackapp · bookstack · CWE-79 XSS	Medium5.4	—	0.6%	Sep 6, 2021
17Monitor	CVE-2021-4026No exploit	Improper Access Control in bookstackapp/bookstackbookstackapp · bookstack · CWE-284 Broken access control (IDOR)	Medium4.3	—	0.9%	Nov 30, 2021
9Monitor	CVE-2023-4624No exploit	Server-Side Request Forgery (SSRF) in bookstackapp/bookstackbookstackapp · bookstack · CWE-918 SSRF	Low2.4	—	0.6%	Aug 30, 2023

CVE-2021-4119
47Plan
Improper Access Control in bookstackapp/bookstack
CriticalCVSS 9.8No exploitEPSS 27%
- Pre-auth
- Broken access control (IDOR)
bookstackapp · bookstackDec 15, 2021
CVE-2020-5256
36Monitor
Remote Code Execution Through Image Uploads in BookStack
HighCVSS 8.8No exploitEPSS 2%
- RCE
bookstackapp · bookstackMar 9, 2020
CVE-2020-26210
34Monitor
Cross-Site Scripting in BookStack
HighCVSS 8.7No exploitEPSS 1%
- XSS
bookstackapp · bookstackNov 3, 2020
CVE-2020-26211
34Monitor
Cross-Site Scripting in BookStack
HighCVSS 8.7No exploitEPSS 1%
- XSS
bookstackapp · bookstackNov 3, 2020
CVE-2024-36676
30Monitor
Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification em
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- XSS
- Denial of service
Jul 9, 2024
CVE-2021-3944
27Monitor
Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack
MediumCVSS 6.8No exploitEPSS 1%
- Pre-auth
- CSRF
bookstackapp · bookstackDec 2, 2021
CVE-2023-6199
26Monitor
Book Stack v23.10.2 - LFR via Blind SSRF
MediumCVSS 6.5Proof of conceptEPSS 1%
- SSRF
bookstackapp · bookstackNov 20, 2023
CVE-2021-3916
26Monitor
Path Traversal in bookstackapp/bookstack
MediumCVSS 6.5No exploitEPSS 1%
- Path traversal
bookstackapp · bookstackNov 5, 2021
CVE-2021-3874
26Monitor
Path Traversal in bookstackapp/bookstack
MediumCVSS 6.5No exploitEPSS 1%
- Path traversal
bookstackapp · bookstackOct 15, 2021
CVE-2021-3758
26Monitor
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack
MediumCVSS 6.5No exploitEPSS 1%
- SSRF
bookstackapp · bookstackSep 2, 2021
CVE-2021-4194
26Monitor
Improper Access Control in bookstackapp/bookstack
MediumCVSS 6.5No exploitEPSS 1%
- Broken access control (IDOR)
bookstackapp · bookstackJan 6, 2022
CVE-2021-3906
26Monitor
Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
MediumCVSS 6.5No exploitEPSS 1%
- File upload
bookstackapp · bookstackOct 27, 2021
CVE-2020-26260
25Monitor
Server Side Request Forgery in BookStack
MediumCVSS 6.4No exploitEPSS 1%
bookstackapp · bookstackDec 9, 2020
CVE-2021-3915
22Monitor
Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
MediumCVSS 5.7No exploitEPSS 1%
- File upload
bookstackapp · bookstackNov 13, 2021
CVE-2022-0877
21Monitor
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
MediumCVSS 5.4No exploitEPSS 1%
- XSS
bookstackapp · bookstackMar 8, 2022
CVE-2020-11055
21Monitor
Cross-site Scripting in BookStack
MediumCVSS 5.4No exploitEPSS 1%
- XSS
bookstackapp · bookstackMay 7, 2020
CVE-2022-40690
21Monitor
Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary scrip
MediumCVSS 5.4No exploitEPSS 1%
- XSS
bookstackapp · bookstackOct 24, 2022
CVE-2017-1000462
21Monitor
BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of serv
MediumCVSS 5.4No exploitEPSS 1%
- XSS
bookstackapp · bookstackJan 3, 2018
CVE-2021-3768
21Monitor
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
MediumCVSS 5.4No exploitEPSS 1%
- XSS
bookstackapp · bookstackSep 6, 2021
CVE-2021-3767
21Monitor
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
MediumCVSS 5.4No exploitEPSS 1%
- XSS
bookstackapp · bookstackSep 6, 2021
CVE-2021-4026
17Monitor
Improper Access Control in bookstackapp/bookstack
MediumCVSS 4.3No exploitEPSS 1%
- Broken access control (IDOR)
bookstackapp · bookstackNov 30, 2021
CVE-2023-4624
9Monitor
Server-Side Request Forgery (SSRF) in bookstackapp/bookstack
LowCVSS 2.4No exploitEPSS 1%
- SSRF
bookstackapp · bookstackAug 30, 2023