Threat database

7 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Critical	9.3	EPSS 0.3%	CVE-2026-25784BlueSpice · Initialization of a Resource with an Insecure Default Critical9.3EPSS 0.3%2026-10-23CVE Database V5CVE-2026-25784 CVE-2026-25784 is a critical vulnerability in Hallo Welt! GmbH BlueSpice container images (versions 5.2.3 up to but not including 5.2.7). It arises from an insecure default initialization of the $mwsgTokenAuthenticatorServiceCIDR setting, which disables IP restrictions on internal service authentication if the related environment variable is unset. This allows any user with read access, including anonymous users on public wikis, to obtain an application token via the REST API and escalate privileges to sysop level. EPSS 0.3%Vulnerability Hallo Welt! GmbH #cwe-1188 #cwe-269	CVE Database V5	2026-10-23
High	7.1	EPSS 0.2%	CVE-2026-25716BlueSpice · Missing Authorization High7.1EPSS 0.2%2026-10-23CVE Database V5CVE-2026-25716 CVE-2026-25716 is a missing authorization vulnerability in Hallo Welt! GmbH BlueSpice affecting the BlueSpiceUserManager extension. Authenticated users without special privileges can block or unblock arbitrary user accounts, including administrators, via REST endpoints that do not verify permissions. This can lead to denial of service by locking out administrators or unauthorized removal of blocks imposed by administrators. The issue affects BlueSpice versions from 5.0.0 before 5.1.11 and from 5.2.0 before 5.2.7. EPSS 0.2%Vulnerability Hallo Welt! GmbH #cwe-862	CVE Database V5	2026-10-23
Medium	6.6	EPSS 0.3%	CVE-2026-24732BlueSpice · Files or Directories Accessible to External Parties Medium6.6EPSS 0.3%2026-03-04CVE Database V5CVE-2026-24732 Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This issue affects BlueSpice: from 5.1 through 5.1.3, from 5.2 through 5.2.0. HINT: Versions provided apply to BlueSpice MediaWiki releases. For Extension:NSFileRepo the affected versions are 3.0 < 3.0.5 EPSS 0.3%Vulnerability Hallo Welt! GmbH #cwe-552 #cwe-732 Germany+9	CVE Database V5	2026-03-04
Medium	5.9	EPSS 0.2%	CVE-2025-58114BlueSpice · Improper Input Validation Medium5.9EPSS 0.2%2025-09-19CVE Database V5CVE-2025-58114 Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects BlueSpice: from 5 through 5.1.1. EPSS 0.2%Vulnerability Hallo Welt! GmbH #cwe-20 Germany+4	CVE Database V5	2025-09-19
Medium	5.9	EPSS 0.2%	CVE-2025-57880BlueSpice · Improper Encoding or Escaping of Output Medium5.9EPSS 0.2%2025-09-19CVE Database V5CVE-2025-57880 Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1. EPSS 0.2%Vulnerability Hallo Welt! GmbH #cwe-116 Germany+4	CVE Database V5	2025-09-19
Medium	5.9	EPSS 0.2%	CVE-2025-48007BlueSpice · Improper Encoding or Escaping of Output Medium5.9EPSS 0.2%2025-09-19CVE Database V5CVE-2025-48007 Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1. EPSS 0.2%Vulnerability Hallo Welt! GmbH #cwe-116 Germany+5	CVE Database V5	2025-09-19
Medium	5.9	EPSS 0.2%	CVE-2025-46703BlueSpice · Improper Encoding or Escaping of Output Medium5.9EPSS 0.2%2025-09-19CVE Database V5CVE-2025-46703 Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1. EPSS 0.2%Vulnerability Hallo Welt! GmbH #cwe-116 Germany+4	CVE Database V5	2025-09-19

Showing 1–7 of 7 results