OctoPrint Vulnerable to Denial of Service through malformed HTTP request

API key access in settings without reauthentication in OctoPrint

OctoPrint is a web interface for 3D printers

The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files

Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0

Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint

OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint

OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication

Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3

OctoPrint API Key settings.py getSettings information disclosure

OctoPrint Unverified Password Change via Access Control Settings

OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

OctoPrint: XSS in Suppressed Command Notifications

OctoPrint vulnerable to possible file extraction via upload endpoints

OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's…

OctoPrint Authenticated Reverse Proxy Page Authentication Bypass