Onenav

CVE-2025-28097 Mar 28, 22:15 MEDIUM POC This Month

OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

CVE-2025-28096 Mar 28, 22:15 MEDIUM POC This Month

OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-7210 Jan 07, 10:15 HIGH This Week

A vulnerability was found in OneNav up to 0.9.33. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-26276 Mar 12, 01:15 MEDIUM This Month

An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-38712 Aug 16, 04:15 HIGH POC This Week

OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-38138 Aug 05, 16:15 MEDIUM POC This Month

OneNav beta 0.9.12 allows XSS via the Add Link feature. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.