Passbolt: >> Passbolt Api Security Vulnerabilities
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
CVSS Score
7.5
EPSS Score
0.0
Published
2025-03-10
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.
CVSS Score
4.3
EPSS Score
0.003
Published
2024-04-26
Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace
CVSS Score
5.4
EPSS Score
0.003
Published
2018-01-02