Todoist

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest
CVE-2025-63317 MEDIUM POC This Month

Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment.

XSS Todoist
NVD GitHub
CVSS 3.1
5.4
EPSS
0.1%
CVE-2025-57292 MEDIUM POC This Month

Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS Todoist
NVD GitHub
CVSS 3.1
6.1
EPSS
0.0%
CVE-2025-63317
EPSS 0% CVSS 5.4
MEDIUM POC This Month

Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment.

XSS Todoist
NVD GitHub
CVE-2025-57292
EPSS 0% CVSS 6.1
MEDIUM POC This Month

Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS Todoist
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy