Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2980▼ 83 respecto a la semana anterior
Críticas / altas1452▲ 101 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)353▼ 157 respecto a la semana anterior
10 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Media (6.5) | 0.34% | — | FriendicaAI | 11/8/2026 | 28/8/2026 | A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny list. An attacker can… | |
| Aplazada | Crítica (9.8) | 0.61% | 💥 PoC | FriendicaAI | 11/8/2026 | 3/9/2026 | An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement… | |
| Modificada | Media (5.4) | 0.34% | — | Friendica | 20/8/2024 | 17/6/2026 | Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters. | |
| Analizada | Media (6.1) | 0.31% | — | Friendica | 15/8/2024 | 17/6/2026 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the file attachment parameter. | |
| Analizada | Crítica (9.8) | 0.80% | — | Friendica | 15/8/2024 | 17/6/2026 | Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature. | |
| Analizada | Media (6.1) | 0.39% | — | Friendica | 15/8/2024 | 17/6/2026 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature. | |
| Analizada | Media (6.1) | 0.33% | — | Friendica | 15/8/2024 | 17/6/2026 | Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter of the babel debug feature. | |
| Analizada | Media (6.1) | 0.50% | — | Friendica | 3/4/2024 | 17/6/2026 | Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the BBCode tags in the post content and post comments function. | |
| Aplazada | Crítica (9.1) | 0.72% | — | FriendicaAI | 3/4/2024 | 17/6/2026 | Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the fpostit.php component. | |
| Modificada | Alta (7.5) | 1.5% | — | Friendica | 5/4/2021 | 17/6/2026 | Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an attempted access to an array offset on a value of type null, and excessive memory consumption. NOTE: the vendor states "the feature still requires a valid authentication cookie… |