Etherpad CVE-2018-9326

Etherpad Lite before 1.6.4 is exploitable for admin access. Rated critical severity (CVSS 9.8), this vulnerability is re

An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary cod

A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary

Privilege escalation to administrative API access in Etherpad 2.1.0 through 3.0.x lets any authenticated non-admin OAuth

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass

Stored cross-site scripting in Etherpad before 3.3.1 lets any user with write access to a pad execute arbitrary JavaScri

Etherpad is a real-time collaborative editor. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to rea

Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. Rated high severity (C

Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. Rated high sev

Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledg

templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated