Every CVE whose affected-product data names Xwiki Cryptpad, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (5)
CVE-2025-49591 — CVSS 9.1 (critical): CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially…
CVE-2025-51846 — CVSS 7.5 (high): CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for…
CVE-2019-15302 — CVSS 6.5 (medium): The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing…
CVE-2017-1000051 — CVSS 6.1 (medium): Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web…
CVE-2025-49590 — CVSS 6.1 (medium): CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to…