Skip to content
Noroxi

FreshRSS records

22 published records for vendor freshrss.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
50%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 22
  3. 23
  4. 25
  5. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

22 records
  • CVE-2025-54875
    39Monitor

    FreshRSS: Unauthorized creation of admin user when registration is enabled

    CriticalCVSS 9.8No exploitEPSS 1%

    freshrss · freshrssSep 29, 2025

  • CVE-2025-54592
    35Monitor

    FreshRSS has Incomplete Session Termination on Logout

    HighCVSS 8.8No exploitEPSS 1%

    freshrss · freshrssSep 29, 2025

  • CVE-2022-23497
    30Monitor

    Insecure file access in FreshRSS

    HighCVSS 7.5No exploitEPSS 1%

    freshrss · freshrssDec 9, 2022

  • CVE-2025-68148
    30Monitor

    FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After

    HighCVSS 7.5No exploitEPSS 0%

    freshrss · freshrssDec 26, 2025

  • CVE-2025-54591
    30Monitor

    FreshRSS: Unauthenticated users can view default user's information

    HighCVSS 7.5No exploitEPSS 0%

    freshrss · freshrssSep 29, 2025

  • CVE-2025-62166
    30Monitor

    FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens

    HighCVSS 7.5No exploitEPSS 0%

    freshrss · freshrssMar 9, 2026

  • CVE-2025-58173
    29Monitor

    FreshRSS vulnerable to authenticated RCE via path traversal inside include()

    HighCVSS 7.4No exploitEPSS 1%

    freshrss · freshrssDec 15, 2025

  • CVE-2025-54593
    28Monitor

    FreshRSS is vulnerable to RCE attacks by authenticated admin

    HighCVSS 7.2No exploitEPSS 1%

    freshrss · freshrssAug 1, 2025

  • CVE-2025-46341
    28Monitor

    Privilege escalation via SSRF when using HTTP auth

    HighCVSS 7.1No exploitEPSS 0%

    freshrss · freshrssJun 4, 2025

  • CVE-2025-61586
    27Monitor

    FreshRSS is vulnerable to directory enumeration by setting path in its theme field

    MediumCVSS 6.9No exploitEPSS 0%

    freshrss · freshrssSep 30, 2025

  • CVE-2025-32015
    26Monitor

    FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>

    MediumCVSS 6.7No exploitEPSS 0%

    freshrss · freshrssJun 4, 2025

  • CVE-2025-59949
    26Monitor

    FreshRSS has Logout CSRF that Leads to DoS via <track src>

    MediumCVSS 6.5No exploitEPSS 0%

    freshrss · freshrssDec 18, 2025

  • CVE-2018-19782
    25Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script

    MediumCVSS 6.1Proof of conceptEPSS 4%

    freshrss · freshrssJan 30, 2019

  • CVE-2023-22481
    22Monitor

    Sensitive information exposure in the logs of greader API in FreshRSS

    MediumCVSS 5.5No exploitEPSS 0%

    freshrss · freshrssMar 6, 2023

  • CVE-2025-31134
    22Monitor

    FreshRSS vulnerable to directory enumeration via ext.php

    MediumCVSS 5.5No exploitEPSS 0%

    freshrss · freshrssJun 4, 2025

  • CVE-2025-31136
    21Monitor

    FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entry

    MediumCVSS 5.4No exploitEPSS 0%

    freshrss · freshrssJun 4, 2025

  • CVE-2025-59948
    21Monitor

    FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page

    MediumCVSS 5.4No exploitEPSS 0%

    freshrss · freshrssSep 29, 2025

  • CVE-2025-59950
    21Monitor

    FreshRSS: Double clickjacking can lead to privilege escalation

    MediumCVSS 5.4No exploitEPSS 0%

    freshrss · freshrssSep 30, 2025

  • CVE-2025-57769
    21Monitor

    FressRSS: Clickjacking can lead to XSS and/or privilege escalation

    MediumCVSS 5.3No exploitEPSS 0%

    freshrss · freshrssSep 29, 2025

  • CVE-2025-31482
    17Monitor

    FreshRSS vulnerable to DoS by malicious feed entry loading logout URL

    MediumCVSS 4.3No exploitEPSS 0%

    freshrss · freshrssJun 4, 2025

  • CVE-2025-46339
    17Monitor

    FreshRSS vulnerable to favicon cache poisoning via proxy

    MediumCVSS 4.3No exploitEPSS 0%

    freshrss · freshrssJun 4, 2025

  • CVE-2025-68932
    11Monitor

    FreshRSS has weak cryptographic randomness in remember-me token and nonce generation

    LowCVSS 2.9No exploitEPSS 1%

    freshrss · freshrssDec 26, 2025