Skip to content
Noroxi

keystonejs records

14 published records for vendor keystonejs.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
85.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 21
  4. 22
  5. 23
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

14 records
  • CVE-2022-29354
    40Plan

    An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted

    CriticalCVSS 9.8No exploitEPSS 3%

    keystonejs · keystoneMay 16, 2022

  • CVE-2022-39382
    39Monitor

    NODE_ENV in Keystone defaults to development with esbuild

    CriticalCVSS 9.8No exploitEPSS 2%

    keystonejs · keystoneNov 3, 2022

  • CVE-2022-39322
    39Monitor

    @keystone-6/core vulnerable to field-level access-control bypass for multiselect field

    CriticalCVSS 9.8No exploitEPSS 1%

    keystonejs · keystoneOct 25, 2022

  • CVE-2017-15879
    37Monitor

    CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in Keystone

    HighCVSS 8.8Proof of conceptEPSS 7%

    keystonejs · keystoneOct 24, 2017

  • CVE-2017-16570
    36Monitor

    KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number S

    HighCVSS 8.8Proof of conceptEPSS 2%

    keystonejs · keystoneNov 6, 2017

  • CVE-2015-9240
    30Monitor

    Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched

    HighCVSS 7.5No exploitEPSS 1%

    keystonejs · keystoneMay 29, 2018

  • CVE-2017-15878
    25Monitor

    A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact

    MediumCVSS 6.1Proof of conceptEPSS 3%

    keystonejs · keystoneOct 24, 2017

  • CVE-2022-0087
    25Monitor

    Cross-site Scripting (XSS) - Reflected in keystonejs/keystone

    MediumCVSS 6.1Proof of conceptEPSS 3%

    keystonejs · keystoneJan 11, 2022

  • CVE-2021-32624
    21Monitor

    Private Field data leak

    MediumCVSS 5.3No exploitEPSS 1%

    keystonejs · keystone-5May 24, 2021

  • CVE-2023-40027
    21Monitor

    Conditionally missing authorization in @keystone-6/core

    MediumCVSS 5.3No exploitEPSS 1%

    keystonejs · keystoneAug 15, 2023

  • CVE-2017-15881
    19Monitor

    Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web scri

    MediumCVSS 4.8No exploitEPSS 1%

    keystonejs · keystoneOct 24, 2017

  • CVE-2025-46720
    17Monitor

    Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields

    MediumCVSS 4.3No exploitEPSS 0%

    keystonejs · keystoneMay 5, 2025

  • CVE-2026-33326
    17Monitor

    @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany

    MediumCVSS 4.3No exploitEPSS 0%

    keystonejs · keystoneMar 24, 2026

  • CVE-2023-34247
    16Monitor

    @keystone-6/auth Open Redirect vulnerability

    MediumCVSS 4.1No exploitEPSS 0%

    keystonejs · keystoneJun 13, 2023