syncfusion records

7 published records for vendor syncfusion.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')6
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

7 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2023-26563No exploit	The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal.syncfusion · nodejs file system provider · CWE-22 Pre-auth Path traversal	Critical9.8	—	1.9%	Jul 12, 2023
40Plan	CVE-2023-26564No exploit	The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal.syncfusion · ej2 aspcore file provider · CWE-22 Pre-auth Path traversal	Critical9.8	—	1.7%	Jul 12, 2023
37Monitor	CVE-2026-65687No exploit	Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processingsyncfusion · standalone report designer · CWE-22 Pre-auth Path traversal	Critical9.3	—	0.9%	Jul 23, 2026
37Monitor	CVE-2026-65688No exploit	Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processingsyncfusion · standalone report designer · CWE-22 Pre-auth Path traversal	Critical9.3	—	0.9%	Jul 23, 2026
37Monitor	CVE-2026-65689No exploit	Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Downloadsyncfusion · standalone report designer · CWE-22 Pre-auth Path traversal	Critical9.3	—	0.9%	Jul 23, 2026
34Monitor	CVE-2026-65690No exploit	Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Uploadsyncfusion · standalone report designer · CWE-22 RCE Path traversal	High8.7	—	0.9%	Jul 23, 2026
21Monitor	CVE-2025-63260No exploit	SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message.syncfusion · syncfusion · CWE-79 XSS	Medium5.4	—	0.2%	Mar 20, 2026

CVE-2023-26563
40Plan
The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- Path traversal
syncfusion · nodejs file system providerJul 12, 2023
CVE-2023-26564
40Plan
The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- Path traversal
syncfusion · ej2 aspcore file providerJul 12, 2023
CVE-2026-65687
37Monitor
Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Path traversal
syncfusion · standalone report designerJul 23, 2026
CVE-2026-65688
37Monitor
Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processing
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Path traversal
syncfusion · standalone report designerJul 23, 2026
CVE-2026-65689
37Monitor
Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Path traversal
syncfusion · standalone report designerJul 23, 2026
CVE-2026-65690
34Monitor
Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload
HighCVSS 8.7No exploitEPSS 1%
- RCE
- Path traversal
syncfusion · standalone report designerJul 23, 2026
CVE-2025-63260
21Monitor
SyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message.
MediumCVSS 5.4No exploitEPSS 0%
- XSS
syncfusion · syncfusionMar 20, 2026