Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Mar 25, 2026Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, viCVE-2026-30587 · Other software · Seafile · reported by MITREHigh 8.7
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags
- Product
- Seafile Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 4, 2025A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12.CVE-2025-65516 · Other software · Seafile · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim's browser. This issue has been fixed in Seafile Community Edition 13.0.12.
- Product
- Seafile Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.commanual.seafile.com
Dec 4, 2025A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10.CVE-2025-41080 · Other software · Seafile · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with POST parámetro 'p' in '/api/v2.1/repos/{repo_id}/file/'.
- Product
- Seafile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10.CVE-2025-41079 · Other software · Seafile · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'.
- Product
- Seafile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack.CVE-2025-45091 · Other software · reported by MITREMedium 5.4
Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notification and activities.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2023The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.CVE-2023-28874 · Other software · Seafile · reported by MITREMedium 6.1
The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.
- Product
- Seafile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.demanual.seafile.com
Dec 9, 2023An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.CVE-2023-28873 · Other software · Seafile · reported by MITREMedium 5.4
An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
- Product
- Seafile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.demanual.seafile.com
Dec 14, 2021Seafile is an open source cloud storage system.CVE-2021-43820 · Other software · haiwen · reported by GitHubHigh 7.4
Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any **known** library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue.
- Product
- seafile-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."CVE-2021-30146 · Other software · Seafile · reported by MITREMedium 5.4
Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
- Product
- Seafile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2020The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory.CVE-2020-16143 · Other software · Seafile · reported by MITREHigh 7.8
The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory.
- Product
- Seafile-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2019Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conducCVE-2013-7469 · Other software · Seafile · reported by MITREHigh 7.5
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
- Product
- Seafile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Feb 18, 2019The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBCCVE-2019-8919 · Other software · Seafile · reported by MITREHigh 7.5
The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
- Product
- Seadroid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2018Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accountCVE-2014-5443 · Other software · Seafile · reported by MITREHigh 7.8
Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling user accounts.
- Product
- Seafile Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.