Vulnerabilidades en decidim

28 resultados
Análisis Vexday

Decidim tem 19 vulnerabilidades registradas, com 2 classificadas como críticas e nenhuma sob ataque ativo no momento. A fraqueza dominante é XSS (CWE-79), padrão em plataformas web, sem eventos de publicação nos últimos 90 dias, indicando risco estabilizado e não imediato.

CVE-2023-34090HIGHDecidim vulnerable to sensitive data disclosureEPSS 1.3%CVE-2023-32693HIGHDecidim Cross-site Scripting vulnerability in the external link redirectionsEPSS 0.8%CVE-2023-48220MEDIUMDecidim's devise_invitable gem vulnerable to circumvention of invitation token expiry periodEPSS 0.8%CVE-2023-34089HIGHDecidim Cross-site Scripting vulnerability in the processes filterEPSS 0.7%CVE-2023-36465CRITICALDecidim has broken access control in templatesEPSS 0.5%CVE-2023-51447MEDIUMDecidim vulnerable to cross-site scripting (XSS) in the dynamic file uploadsEPSS 0.5%CVE-2024-27090MEDIUMDecidim vulnerable to data disclosure through the embed featureEPSS 0.5%CVE-2023-47634LOWDecidim has race condition in EndorsementsEPSS 0.4%CVE-2024-32469HIGHDecidim has cross-site scripting (XSS) in the paginationEPSS 0.4%CVE-2024-41673HIGHDecidim has a cross-site scripting vulnerability in the version control pageEPSS 0.4%CVE-2026-23891CRITICALDecidim has a Cross-site scripting (XSS) vulnerability via user name fieldEPSS 0.4%CVE-2024-32034MEDIUMCross-site scripting (XSS) in the decidim admin activity logEPSS 0.4%CVE-2024-27095MEDIUMDecidim cross-site scripting (XSS) in the admin panelEPSS 0.3%CVE-2026-45376MEDIUMDecidim: Admin user search allows SQL injection through similarity-based sortingEPSS 0.3%CVE-2023-47635MEDIUMDecidim vulnerable to possible CSRF attack at questionnaire templates previewEPSS 0.3%CVE-2026-40870HIGHDecidim's comments API allows access to all commentable resourcesEPSS 0.3%CVE-2026-45330MEDIUMDecidim: Verification admins can access supplied IDs from other organisationsEPSS 0.3%CVE-2026-45377MEDIUMDecidim: Private exports can be downloaded through reusable linksEPSS 0.3%CVE-2025-65017HIGHDecidim's private data exports can lead to data leaksEPSS 0.3%CVE-2024-39910MEDIUMCross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editorEPSS 0.3%