repository icon
answerdev / answer Project repository

A Q&A platform software for teams at any scales. Whether it's a community forum, help center, or knowledge management platform, you can always count on Apache Answer.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN28 DAYS

FIX

WITHIN32 DAYS

Race Condition in Signup Allows Users To Create Duplicate Accounts with Same Ema...
kevinnivekkevin
pending
Stored XSS via Customize CSS/HTML Feature
kevinnivekkevin
self closed
Expose user IP if user comment
jobert-krohnen
pending
Stored XSS on Login Dashboard via config OAuth plug-in
jobert-krohnen
pending
IP of the questioner is leaked
pachinko2821
pending
IDOR Vulnerability Allow Low-Level User change role Everyone Includes Admin
m4noo
High
•CVE-2023-4815
attackers with role "USER" can create tags
lujiefsi
High
•CVE-2023-4124
Race Condition Vulnerability Allowing Arbitrary Control of Comment Likes
ek1ng
pending
Race Condition Allows Attacker to Increase/Decrease Bookmarks in ≤ 1.0.9 [ Bypas...
whoisshuvam
pending
Deleted Questions can be still visible
whoisshuvam
pending
Weak Password policy on account registration
earth2sky
High
•CVE-2023-4125
Session is not expiring after password reset
akshayravic09yc47
Medium
•CVE-2023-4126
Activation Link is not expired
baobaovt
pending
Improper Logic at Change Info function lead an user can remove his username and...
baobaovt
pending
Improper Authorization lead a user can accept his answer as the best answer
baobaovt
High
•CVE-2023-2590
Activation Link is not expired
baobaovt
self closed
Mail Server Misconfiguration
oiiwroo
pending
Host Header Injection
pentrext
pending
Broken Access Control (User's Information Disclosure)
pentrext
pending
Concurrent sessions not automatically logged out after a successful password cha...
b1tch3s
pending
Password Enumeration Attack on Change Password Process
b1tch3s
pending
Stored XSS in Edit History
jeeseensec
pending
Pre-Account Takeover Vulnerability in Answer Dev through Unauthorized Email Addr...
paragbagul111
pending
Pre-Account Takeover Vulnerability in Answer Dev through Unauthorized Email Addr...
paragbagul111
self closed
Dom-based Stored XSS Vulnerability
eternyle
pending
Information leakage in EXIF data of images
nilabhrajpoot
High
•CVE-2023-1974
Lack Of Password Confirmation Change Email Address
nilabhrajpoot
self closed
a
tht1997
self closed
Stored XSS in edit_summary while Editing a Tag
karthik983
pending
Weak Authorization
oiiwroo
pending
open redirect
oiiwroo
self closed
Password reset link not expired
oiiwroo
Medium
•CVE-2023-1976
Store XSS in create tag
zoro2000
High
•CVE-2023-1536
EXIF Geolocation Data Not Stripped From brand logo
ghostbit11
High
•CVE-2023-1975
Multiple XSS @ answer/question/tag
hatlesswizard
High
•CVE-2023-1535
Store XSS in Question Tag
jeeseensec
High
•CVE-2023-1242
Authorization Token Never Expires
jplopezy
Medium
•CVE-2023-1543
Presence of Clickjacking CMSWIDE
shuvamoy
pending
Insecure Business Logic - Client Side Enforcement Bypass on User Account Deletio...
dievus
High
•CVE-2023-1542
Captcha Bypass due to invalidation of previous tokens
shuvamoy
Medium
•CVE-2023-1537
Stored XSS in Sitename
shuvamoy
Critical
•CVE-2023-1244
Observable Response Discrepancy in Password Reset Functionality
dievus
Medium
•CVE-2023-1540
Observable Timing Discrepancy in Login Portal
dievus
Medium
•CVE-2023-1538
Admin Able To Perform Operations On Themselves By Interacting With API
1d8
Medium
•CVE-2023-1541
Captcha Bypass on login
hatlesswizard
Medium
•CVE-2023-1539
XSS
hatlesswizard
Low
•CVE-2023-1245
HTML Injection in Answerdev ≤ v1.0.5
whoisshuvam
pending
Race Condition Vulnerability can Leads to Up Vote Stealing
ko-kn3t
Medium
•CVE-2023-4127
User enumeration
n00b08
pending
Stored XSS
mike993
Medium
•CVE-2023-1243
Bypass captcha
ch1nhpd
pending
UI Redressing
lengochoa7112000
pending
Stored XSS on Tag
kevinkien
High
•CVE-2023-1241
Stored DOM-based Cross-site Scripting in Tags Functionality
mattzajork
High
•CVE-2023-1240
Stored XSS Bypass While add a new Comment
mohamedabdelhady933
High
•CVE-2023-1238
Stored XSS in Site Name
sanket-722
Medium
•CVE-2023-1239
Complex xss to bypass protection
christynorl
Low
•CVE-2023-1237
Stored XSS in Tags
sanket-722
pending
Multiple stored XSS
blueudp
Medium
•CVE-2023-0934
Account Takeover via reset password
blueudp
Critical
•CVE-2023-0744
Race Conditional exists in the collection
1derian
High
•CVE-2023-0739
Stored XSS in Your Answer
1derian
High
•CVE-2023-0742
Image upload function has storage xss vulnerability
shangrui-hash
High
•CVE-2023-0743
Dom XSS in Add Question
1derian
High
•CVE-2023-0741
Function of modifying userinfo has storage xss vulnerability
shangrui-hash
High
•CVE-2023-0740