Csprousers: >> Csweb >> 8.0.1 Security Vulnerabilities
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.
CVSS Score
9.1
EPSS Score
0.0
Published
2026-03-23
Census CSWeb 8.0.1 allows arbitrary file upload. A remote, authenticated attacker could upload a malicious file, possibly leading to remote code execution. Fixed in 8.1.0 alpha.
CVSS Score
8.8
EPSS Score
0.002
Published
2026-03-23
Census CSWeb 8.0.1 allows stored cross-site scripting in user supplied fields. A remote, authenticated attacker could store malicious javascript that executes in a victim's browser. Fixed in 8.1.0 alpha.
CVSS Score
4.6
EPSS Score
0.0
Published
2026-03-23