What’s Vulnerable › Products

Hallo Welt! GmbH BlueSpice vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Hallo Welt! GmbH BlueSpice version is affected

Latest Hallo Welt! GmbH BlueSpice vulnerabilities

• CVE-2026-25784 — bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop (CVSS 9.8)
• CVE-2026-25716 — BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users (CVSS 7.1)
• CVE-2026-24732 — Improper permission checks in Extension:NSFileRepo (CVSS 6.6)
• CVE-2025-58114 — Potential XSS in Extension:CognitiveProcessDesigner (CVSS 4.8)
• CVE-2025-57880 — Potential XSS in Extension:BlueSpiceWhoIsOnline (CVSS 5.4)
• CVE-2025-48007 — Potential XSS in Extension:BlueSpiceAvatars (CVSS 6.4)
• CVE-2025-46703 — Potential XSS in Extension:AtMentions (CVSS 6.4)
• CVE-2023-42431 — Potential XSS on user preferences page (CVSS 5.4)
• CVE-2022-42001 — Potential XSS in book navigation (CVSS 5.4)
• CVE-2022-42000 — Potential XSS in comment section (CVSS 5.4)
• CVE-2022-41814 — Potential XSS in history view (CVSS 5.4)
• CVE-2022-41789 — Potential XSS on default page header (CVSS 5.4)
• CVE-2022-41611 — Potential XSS on sidebar navigation (CVSS 4.8)
• CVE-2022-3958 — Potential XSS on personal menu navigation (CVSS 5.4)
• CVE-2022-3895 — Potential XSS in common user interface component library (CVSS 6.1)
• CVE-2022-3893 — Potential XSS on custom menu navigation (CVSS 4.8)
• CVE-2022-2511 — Potential XSS in title URL parameter (CVSS 6.1)
• CVE-2022-2510 — Potential XSS on Special:SearchCenter (CVSS 6.1)