indico vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Latest indico vulnerabilities

CVE-2026-108388 — Indico legacy contribution export cache poisoning discloses restricted metadata (CVSS 3.5)
CVE-2026-107397 — Indico: Cross-Site-Scripting in minutes editor (CVSS 4.4)
CVE-2026-107396 — Indico: Cross-Site-Scripting in link fields (CVSS 5.4)
CVE-2026-107395 — Indico: Missing access check in legacy session export API (CVSS 4.3)
CVE-2026-107394 — Indico: Incomplete Server-Side Request Forgery (SSRF) check (CVSS 6.8)
CVE-2026-33046 — Indico discloses local files resulting in Remote Code Execution through LaTeX injection (CVSS 8.8)
CVE-2026-28352 — Indico missing access check in event series management API (CVSS 6.5)
CVE-2026-25739 — Indico affected by Cross-Site-Scripting via material uploads (CVSS 5.4)
CVE-2026-25738 — Indico has Server-Side Request Forgery (SSRF) in multiple places (CVSS 4.3)
CVE-2025-59035 — Indico vulnerable to Cross-Site Scripting via LaTeX math code (CVSS 5.4)
CVE-2025-59034 — Indico may disclose unauthorized user details access via legacy API (CVSS 4.3)
CVE-2025-53640 — Indico vulnerable to user enumeration via API endpoint (CVSS 6.5)
CVE-2024-50633 — (CVSS 7.5)
CVE-2024-45399 — Indico has a Cross-Site-Scripting during account creation (CVSS 6.1)
CVE-2023-37901 — Cross-Site-Scripting via confirmation prompts (CVSS 5.4)
CVE-2021-30185 — (CVSS 7.5)