Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29 results
Oct 24, 2026BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft CVE-2026-116020 · Other software · BookStackApp · reported by VulnCheckMedium 5.3
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeberg.orgcodeberg.org
Sep 15, 2026BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as CVE-2026-89022 · Other software · bookstackapp · reported by VulnCheckCritical 9.1
BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driver_id namespace. Attackers can authenticate at one enabled social provider using a user ID that matches an account linked to a different social provider, bypassing credential verification entirely because the SocialAuthService::handleLoginCallback query ignores the driver column when retrieving linked account records.
- Product
- bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbookstackapp.comvulncheck.com
Sep 7, 2026A vulnerability was detected in BookStack up to 26.05.2.CVE-2026-86285 · Other software · reported by VulDBLow 2.1
A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper access controls. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 4e406c41c4c8060a5795e74c66fb96362e54f400. It is advisable to implement a patch to correct this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordashutosh-jena.incodeberg.org
Sep 1, 2026BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores CVE-2026-84695 · Other software · bookstackapp · reported by VulnCheckCritical 9.3
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
- Product
- bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and CreatCVE-2026-82450 · Other software · bookstackapp · reported by VulnCheckHigh 8.7
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.
- Product
- bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manCVE-2026-67204 · Other software · BookStackApp · reported by VulnCheckMedium 5.3
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a user avatar's ID to the API controller, which loads any image type without the web controller's gallery and drawio restrictions, and when the avatar's uploaded_to field matches a page ID accessible to the attacker, the authorization check passes allowing the attacker to rename, replace, or delete the target user's avatar without requiring user-management permission.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeberg.orggithub.com
Apr 3, 2026A weakness has been identified in BookStackApp BookStack up to 26.03.CVE-2026-5484 · Other software · BookStackApp · reported by VulDBMedium 5.5
A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 26.03.1 is able to address this issue. This patch is called 8a59895ba063040cc8dafd82e94024c406df3d04. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public fCVE-2024-36676 · Other software · bookstackapp · reported by MITREHigh 7.5
Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.
- Product
- bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023Book Stack version 23.10.2 allows filtering local files on the server.CVE-2023-6199 · Other software · BookStack · reported by help@fluidattacks.comMedium 6.5
Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.combookstackapp.com
Aug 30, 2023Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.CVE-2023-4624 · Other software · bookstackapp · reported by security@huntr.devLow 2.4
Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2022Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script.CVE-2022-40690 · Other software · BookStack · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpbookstackapp.com
Mar 8, 2022Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.CVE-2022-0877 · Other software · bookstackapp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022bookstack is vulnerable to Improper Access ControlCVE-2021-4194 · Other software · bookstackapp · reported by security@huntr.devMedium 6.5
bookstack is vulnerable to Improper Access Control
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021bookstack is vulnerable to Improper Access ControlCVE-2021-4119 · Other software · bookstackapp · reported by security@huntr.devCritical 9.8
bookstack is vulnerable to Improper Access Control
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2021bookstack is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-3944 · Other software · bookstackapp · reported by security@huntr.devMedium 6.8
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021bookstack is vulnerable to Improper Access ControlCVE-2021-4026 · Other software · bookstackapp · reported by security@huntr.devMedium 4.3
bookstack is vulnerable to Improper Access Control
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2021bookstack is vulnerable to Unrestricted Upload of File with Dangerous TypeCVE-2021-3915 · Other software · bookstackapp · reported by security@huntr.devMedium 5.7
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2021-3916 · Other software · bookstackapp · reported by security@huntr.devMedium 6.5
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2021bookstack is vulnerable to Unrestricted Upload of File with Dangerous TypeCVE-2021-3906 · Other software · bookstackapp · reported by security@huntr.devMedium 6.5
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2021bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2021-3874 · Other software · bookstackapp · reported by security@huntr.devMedium 6.5
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3768 · Other software · bookstackapp · reported by security@huntr.devMedium 5.4
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2021bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3767 · Other software · bookstackapp · reported by security@huntr.devMedium 5.4
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2021bookstack is vulnerable to Server-Side Request Forgery (SSRF)CVE-2021-3758 · Other software · bookstackapp · reported by security@huntr.devMedium 6.5
bookstack is vulnerable to Server-Side Request Forgery (SSRF)
- Product
- bookstackapp/bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020BookStack is a platform for storing and organising information and documentation.CVE-2020-26260 · Other software · BookStackApp · reported by GitHubMedium 6.4
BookStack is a platform for storing and organising information and documentation. In BookStack before version 0.30.5, a user with permissions to edit a page could set certain image URL's to manipulate functionality in the exporting system, which would allow them to make server side requests and/or have access to a wider scope of files within the BookStack file storage locations. The issue was addressed in BookStack v0.30.5. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbookstackapp.comgithub.com
Nov 3, 2020In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or fCVE-2020-26211 · Other software · BookStackApp · reported by GitHubHigh 7.7
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a particular meta tag which could be used to silently redirect users to a alternative location upon visit of a page. Dangerous content may remain in the database but will be removed before being displayed on a page. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround without upgrading, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in BookStack version 0.30.4.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2020In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clickedCVE-2020-26210 · Other software · BookStackApp · reported by GitHubHigh 7.7
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in version 0.30.4.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbookstackapp.comgithub.com
May 7, 2020In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation.CVE-2020-11055 · Other software · BookStackApp · reported by GitHubMedium 6.3
In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpbookstackapp.com
Mar 9, 2020BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code oCVE-2020-5256 · Other software · BookStackApp · reported by GitHubHigh 7.9
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability.
- Product
- BookStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2018BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution ofCVE-2017-1000462 · Other software · Bookstackapp · reported by MITREMedium 5.4
BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code.
- Product
- Bookstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.