Packagist Package Vulnerabilities
Vulnerabilities associated with appwrite/server-ce.
Packages
Clear package- moodle/moodle437 vulnerabilities
- magento/community-edition362 vulnerabilities
- typo3/cms188 vulnerabilities
- magento/project-community-edition161 vulnerabilities
- wwbn/avideo144 vulnerabilities
- pimcore/pimcore132 vulnerabilities
- craftcms/cms128 vulnerabilities
- typo3/cms-core127 vulnerabilities
- dolibarr/dolibarr126 vulnerabilities
- concrete5/concrete5119 vulnerabilities
- drupal/core109 vulnerabilities
- phpmyadmin/phpmyadmin107 vulnerabilities
- thorsten/phpmyfaq106 vulnerabilities
- microweber/microweber105 vulnerabilities
- librenms/librenms101 vulnerabilities
- symfony/symfony100 vulnerabilities
- silverstripe/framework90 vulnerabilities
- drupal/drupal81 vulnerabilities
- mantisbt/mantisbt74 vulnerabilities
- shopware/platform74 vulnerabilities
- getgrav/grav69 vulnerabilities
- shopware/core65 vulnerabilities
- snipe/snipe-it57 vulnerabilities
- baserproject/basercms56 vulnerabilities
- mautic/core56 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Appwrite Directory Traversal vulnerabilityThe ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.) CWE-22Feb 22, 2024 | CVSS-v4.0 | EPSS0.793% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-27159HIGH | Appwrite Server-Side Request Forgery vulnerabilityAppwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request. | CVSS7.5v3.1 | EPSS36.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2022-2925MEDIUM | Cross-site Scripting (XSS) - Stored in appwrite/appwriteCross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1. CWE-79Sep 9, 2022 | CVSS5.4v3.1 | EPSS0.688% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-23682HIGH | Prototype PollutionThis affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability. CWE-1321Feb 16, 2022 | CVSS7.3v3.1 | EPSS2.12% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |