Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
26 results
Aug 19, 2026Etherpad is a real-time collaborative editor.CVE-2026-55090 · Other software · ether · reported by GitHubMedium 5.3
Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When a bundled plugin such as ep_font_color or ep_font_size registers the hook, opening the resulting HTML export causes the value to execute as stored cross-site scripting in the Etherpad origin. This issue is fixed in version 3.3.0.
- Product
- etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Etherpad is a real-time collaborative editor.CVE-2026-55089 · Other software · ether · reported by GitHubCritical 9.9
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.
- Product
- etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Etherpad is a real-time collaborative editor.CVE-2026-55088 · Other software · ether · reported by GitHubMedium 6.8
Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although the record includes createdAt, the transfer has no expiration check, is not removed after successful redemption, and is returned by res.send(tokenData), including the raw author token. An unauthenticated attacker who obtains a transfer UUID can repeatedly redeem it, receive fresh author cookies, read the cleartext token, and impersonate the originating author for pad read and write operations. This issue is fixed in version 3.1.0.
- Product
- etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Etherpad is a real-time collaborative editor.CVE-2026-55087 · Other software · ether · reported by GitHubMedium 6.1
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control: private, no-store. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. In src/node/hooks/express/specialpages.ts, version 3.0.0 also accepts a protocol-relative x-proxy-path value when constructing the /p/:pad/timeslider redirect, allowing redirection to an attacker-controlled host. The issues are exploitable when the deployment permits client-supplied x-proxy-path headers to reach Etherpad. This issue is fixed in version 3.1.0.
- Product
- etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Etherpad is a real-time collaborative editor.CVE-2026-55086 · Other software · ether · reported by GitHubMedium 4.2
Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random() and place them in os.tmpdir(). On a host with a shared world-writable temporary directory, a local unprivileged attacker who predicts a filename can precreate a symbolic link to a file writable by the Etherpad process. Subsequent import or export operations can follow the link through fs.writeFile, fs.rename, or document-conversion output and overwrite the target with partially attacker-controlled content. This issue is fixed in version 3.1.0.
- Product
- etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Etherpad is a real-time collaborative editor.CVE-2026-55085 · Other software · ether · reported by GitHubCritical 9.6
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write access to a pad can store markup that executes as cross-site scripting when another user opens the pad or /timeslider, including when an administrator views the pad. This issue is fixed in version 3.3.1.
- Product
- etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2021Etherpad is a real-time collaborative editor.CVE-2021-43802 · Other software · ether · reported by GitHubCritical 9.9
Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute arbitrary code (including system commands). To gain privileges, the attacker must be able to trigger deletion of `express-session` state or wait for old `express-session` state to be cleaned up. Core Etherpad does not delete any `express-session` state, so the only known attacks require either a plugin that can delete session state or a custom cleanup process (such as a cron job that deletes old `sessionstorage:*` records). The problem has been fixed in version 1.8.16. If users cannot upgrade to 1.8.16 or install patches manually, several workarounds are available. Users may configure their reverse proxies to reject requests to `/p/*/import`, which will block all imports, not just `*.etherpad` imports; limit all users to read-only access; and/or prevent the reuse of `express_sid` cookie values that refer to deleted express-session state. More detailed information and general mitigation st
- Product
- etherpad-lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by installing plugins frCVE-2021-34816 · Other software · Etherpad · reported by MITREHigh 7.2
An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by installing plugins from an attacker-controlled source.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Jul 19, 2021A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafteCVE-2021-34817 · Other software · Etherpad · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.cometherpad.org
Apr 28, 2021Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service.CVE-2020-22785 · Other software · Etherpad · reported by MITREHigh 7.5
Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting random pad import endpoints with empty data would flatten all pads due to lack of rate limiting and missing ownership check.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySCVE-2020-22784 · Other software · Etherpad · reported by MITREHigh 7.5
In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names.
- Product
- Ueberdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files.CVE-2020-22783 · Other software · Etherpad · reported by MITREMedium 6.5
Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021Etherpad < 1.8.3 is affected by a denial of service in the import functionality.CVE-2020-22782 · Other software · Etherpad · reported by MITREHigh 7.5
Etherpad < 1.8.3 is affected by a denial of service in the import functionality. Upload of binary file to the import endpoint would crash the instance.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash the instance).CVE-2020-22781 · Other software · Etherpad · reported by MITREHigh 7.5
In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash the instance).
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2020Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of thCVE-2015-3309 · Other software · Etherpad · reported by MITREHigh 7.5
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.killedkenny.ioopenwall.com
Jan 10, 2020The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection VulnerabilityCVE-2013-7380 · Other software · EP Imageconvert Project · reported by MITRECritical 9.8
The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability
- Product
- EP Imageconvert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Oct 18, 2019templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.CVE-2019-18209 · Other software · Etherpad · reported by MITREMedium 6.1
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2018Etherpad Lite before 1.6.4 is exploitable for admin access.CVE-2018-9845 · Other software · Etherpad · reported by MITRECritical 9.8
Etherpad Lite before 1.6.4 is exploitable for admin access.
- Product
- Etherpad Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2018Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server.CVE-2018-9327 · Other software · Etherpad · reported by MITREHigh 8.1
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database (DirtyDB, CouchDB, MongoDB, or RethinkDB).
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.etherpad.orgblog.etherpad.org
Apr 7, 2018Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code.CVE-2018-9326 · Other software · Etherpad · reported by MITRECritical 9.8
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.etherpad.orgblog.etherpad.org
Apr 7, 2018Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names.CVE-2018-9325 · Other software · Etherpad · reported by MITREHigh 7.5
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.etherpad.orgblog.etherpad.org
Feb 8, 2018node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.CVE-2018-6835 · Other software · Etherpad · reported by MITRECritical 9.8
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2018static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href.CVE-2018-6834 · Other software · Etherpad · reported by MITREMedium 6.1
static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href.
- Product
- Etherpad Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2018node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring cheCVE-2015-2298 · Other software · Etherpad · reported by MITREHigh 7.5
node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Sep 7, 2017Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.CVE-2015-4085 · Other software · Etherpad · reported by MITREHigh 7.5
Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Jul 7, 2017Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacemCVE-2015-3297 · Other software · Etherpad · reported by MITREHigh 7.5
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
- Product
- Etherpad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.