repository icon
kareadita / kavita Project repository

Kavita is a fast, feature rich, cross platform reading server. Built with the goal of being a full solution for all your reading needs. Setup your own server and share your reading collection with your friends and family.

Submit a report

FIRST INTERACTION

WITHIN2 DAYS

REVIEW

WITHIN11 DAYS

FIX

WITHIN16 DAYS

Heap Inspection Leads to Recoverable Password
0xdhinu
informative
Medium
Insufficient Session Expiration and account lockout bypass
sumanth-thyagarajan
pending
Email Spoofing using [noreply@kavitareader.com]
sl4x0
informative
High
No ratelimit on resend-confirmation-email
sandeepsrinivasan
pending
Host Header Injection confirmation-email endpoint
sandeepsrinivasan
self closed
Missing Authentication for Critical Function
strik3r0x1
High
•CVE-2023-0919
Server Side Request Forgery
zetc0de
informative
High
No Rate Limit On migrate-email Endpoint Leads to Brute-force Attack
zetc0de
Critical
•CVE-2022-3993
User Enumeration
zetc0de
Critical
•CVE-2022-3945
User can read any series without permission
ssepp
Medium
Stored HTML Injection
mike993
not applicable
UI Redressing
saharshtapi
Critical
•$15
Weak Password Change Mechanism
vultza
Low
Password reset poisoning
vultza
informative
High
IDOR allows to create new collection or modify a existing one
vultza
High
•$10
Unauthenticated reading list item deletion
vultza
High
•$10
Unauthenticated book download and view details
vultza
High
•$10
Unauthenticated Path Traversal
vultza
High
•$10
No password brute-force protection on login page
vultza
Critical
•$15
IDOR in password change page leads to administrative account takeover
vultza
Critical
•$15
Full Read Server-Side Request Forgery (SSRF)
vultza
High
•$10•CVE-2022-2756