Friendica
Monthly
Unauthenticated SQL injection in Friendica (through the 2026.08-dev branch) lets remote attackers inject arbitrary SQL through the photo-view 'order' parameter, which is concatenated unsanitized into a SHOW COLUMNS query executed via a bare PDO::query() call. Because PDO::query() permits stacked statements, an attacker needs no credentials to read, alter, or destroy the entire backing database. No public exploit identified at time of analysis, but the flaw is trivially reachable and carries a CVSS 9.8.
Server-side request forgery in Friendica through the 2026.08-dev branch exposes internal network infrastructure to any authenticated user, including those with a free self-registered account. The link-preview endpoint fetches attacker-supplied URLs without enforcing an internal IP deny list, enabling enumeration of internal services and access to cloud instance metadata endpoints such as the AWS IMDSv1 endpoint at 169.254.169.254. No public exploit code has been identified at time of analysis, but the low privilege barrier - a free self-registered account - significantly broadens the realistic attacker pool on public Friendica instances.
Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the file attachment parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter of the babel debug feature. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the BBCode tags in the post. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an attempted access to an array offset on a value of type. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthenticated SQL injection in Friendica (through the 2026.08-dev branch) lets remote attackers inject arbitrary SQL through the photo-view 'order' parameter, which is concatenated unsanitized into a SHOW COLUMNS query executed via a bare PDO::query() call. Because PDO::query() permits stacked statements, an attacker needs no credentials to read, alter, or destroy the entire backing database. No public exploit identified at time of analysis, but the flaw is trivially reachable and carries a CVSS 9.8.
Server-side request forgery in Friendica through the 2026.08-dev branch exposes internal network infrastructure to any authenticated user, including those with a free self-registered account. The link-preview endpoint fetches attacker-supplied URLs without enforcing an internal IP deny list, enabling enumeration of internal services and access to cloud instance metadata endpoints such as the AWS IMDSv1 endpoint at 169.254.169.254. No public exploit code has been identified at time of analysis, but the low privilege barrier - a free self-registered account - significantly broadens the realistic attacker pool on public Friendica instances.
Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the file attachment parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter of the babel debug feature. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the BBCode tags in the post. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an attempted access to an array offset on a value of type. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.