Heptabase
Monthly
Stored XSS in Heptabase by Hepta Platforms, Inc. allows authenticated attackers to inject persistent malicious JavaScript into specific application pages, which then executes in the browsers of other users who interact with the crafted content. All versions are affected per CPE data (cpe:2.3:a:hepta_platforms:heptabase:*), and the CVSS 4.0 vector scores high subsequent-system confidentiality and integrity impact (SC:H/SI:H), meaning victim users' sessions and data are meaningfully at risk. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the need for the attacker to hold a valid account and for victims to actively click the injected content.
Unauthorized camera and microphone access in Heptabase by Hepta Platforms is achievable by unauthenticated remote attackers who social-engineer a victim into opening a malicious webpage inside the application, exploiting an exposed dangerous method (CWE-749) that bypasses normal permission gating. The attack yields high confidentiality impact - real-time audio and video capture - with no privileges required on the attacker's side, constrained only by the need for active victim interaction. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the surveillance-class outcome makes it attractive for targeted campaigns.
Stored XSS in Heptabase by Hepta Platforms, Inc. allows authenticated attackers to inject persistent malicious JavaScript into specific application pages, which then executes in the browsers of other users who interact with the crafted content. All versions are affected per CPE data (cpe:2.3:a:hepta_platforms:heptabase:*), and the CVSS 4.0 vector scores high subsequent-system confidentiality and integrity impact (SC:H/SI:H), meaning victim users' sessions and data are meaningfully at risk. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the need for the attacker to hold a valid account and for victims to actively click the injected content.
Unauthorized camera and microphone access in Heptabase by Hepta Platforms is achievable by unauthenticated remote attackers who social-engineer a victim into opening a malicious webpage inside the application, exploiting an exposed dangerous method (CWE-749) that bypasses normal permission gating. The attack yields high confidentiality impact - real-time audio and video capture - with no privileges required on the attacker's side, constrained only by the need for active victim interaction. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the surveillance-class outcome makes it attractive for targeted campaigns.