squidex vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Latest squidex vulnerabilities

CVE-2026-41177 — Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction (CVSS 5.5)
CVE-2026-41172 — Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets) (CVSS 7.3)
CVE-2026-41171 — SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient (CVSS 7.3)
CVE-2026-41170 — Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests (CVSS 7.2)
CVE-2026-24736 — Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration (CVSS 8.8)
CVE-2023-46857 — (CVSS 5.4)
CVE-2023-46253 — Remote code execution in Squidex (CVSS 7.2)
CVE-2023-46252 — Cross-Site Scripting (XSS) via postMessage Handler in Squidex (CVSS 6.1)
CVE-2023-46744 — Stored Cross-site Scripting in Squidex (CVSS 5.4)
CVE-2023-3580 — Improper Handling of Additional Special Element in squidex/squidex (CVSS 4.3)
CVE-2023-24278 — (CVSS 6.1)
CVE-2023-0643 — Improper Handling of Additional Special Element in squidex/squidex (CVSS 6.1)
CVE-2023-0642 — Cross-Site Request Forgery (CSRF) in squidex/squidex (CVSS 6.5)