Wallabag
Monthly
Cross-site scripting in the wallabag Android application (fr.gaulupeau.apps.InThePoche) through version 2.6.0 allows execution of attacker-controlled JavaScript within the app's WebView. Article content fetched from the /api/entries endpoint is rendered in a WebView without sanitization, meaning malicious markup embedded in saved articles executes in the application's security context. A publicly available proof-of-concept references the specific vulnerable source files in the upstream repository; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 8.8 with scope change indicators reflects elevated real-world risk.
Server-Side Request Forgery in wallabag 2.x through 2.6.14 enables authenticated users to coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via a maliciously crafted article title or content field that is processed during PDF export. The scope change in the CVSS vector (S:C) reflects that the SSRF escapes the wallabag application boundary and can reach backend services, cloud metadata endpoints, or internal network hosts invisible to the attacker directly. A separate full-disclosure post references this same advisory with a higher CVSS score of 8.5 and also mentions a Stored XSS vector, suggesting the attack surface may be broader than the NVD 6.4 score implies. No public exploit identified at time of analysis.
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability was found in wallabag 2.5.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting in the wallabag Android application (fr.gaulupeau.apps.InThePoche) through version 2.6.0 allows execution of attacker-controlled JavaScript within the app's WebView. Article content fetched from the /api/entries endpoint is rendered in a WebView without sanitization, meaning malicious markup embedded in saved articles executes in the application's security context. A publicly available proof-of-concept references the specific vulnerable source files in the upstream repository; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 8.8 with scope change indicators reflects elevated real-world risk.
Server-Side Request Forgery in wallabag 2.x through 2.6.14 enables authenticated users to coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via a maliciously crafted article title or content field that is processed during PDF export. The scope change in the CVSS vector (S:C) reflects that the SSRF escapes the wallabag application boundary and can reach backend services, cloud metadata endpoints, or internal network hosts invisible to the attacker directly. A separate full-disclosure post references this same advisory with a higher CVSS score of 8.5 and also mentions a Stored XSS vector, suggesting the attack surface may be broader than the NVD 6.4 score implies. No public exploit identified at time of analysis.
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability was found in wallabag 2.5.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.