BO
Vendor
bookstackapp
28
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116020 New | BO BookStack BookStackApp | 5.4 | Oct 24 | BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages |
| CVE-2026-89022 | BO bookstack bookstackapp | 7.4 | Sep 15 | BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion |
| CVE-2026-84695 | BO bookstack bookstackapp | 8.7 | Sep 2 | BookStack before 26.05.4 Stored XSS via Drawing Upload |
| CVE-2026-82450 | BO bookstack bookstackapp | 8.8 | Aug 29 | BookStack before 26.05.4 Remote Code Execution via Book Cover |
| CVE-2026-67204 | BO BookStack BookStackApp | 5.4 | Aug 24 | BookStack < 26.05.4 Broken Access Control via Image Gallery API |
| CVE-2026-5484 | BO BookStack BookStackApp | 5.3 | Apr 3 | BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control |
| CVE-2024-36676 | BO Bookstack Bookstackapp | 7.5 | Jul 9 | Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms |
| CVE-2023-6199 | BO Bookstack Bookstackapp | 6.5 | Nov 20 | Book Stack version 23.10.2 allows filtering local files on the server |
| CVE-2023-4624 | BO Bookstack Bookstackapp | 2.4 | Aug 30 | Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08 |
| CVE-2022-40690 | BO Bookstack Bookstackapp | 5.4 | Oct 24 | Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script |
| CVE-2022-0877 | BO Bookstack Bookstackapp | 5.4 | Mar 8 | Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3 |
| CVE-2021-4194 | BO Bookstack Bookstackapp | 6.5 | Jan 6 | bookstack is vulnerable to Improper Access Control |
| CVE-2021-4119 | BO Bookstack Bookstackapp | 9.8 | Dec 15 | bookstack is vulnerable to Improper Access Control |
| CVE-2021-3944 | BO Bookstack Bookstackapp | 6.8 | Dec 2 | bookstack is vulnerable to Cross-Site Request Forgery (CSRF) |
| CVE-2021-4026 | BO Bookstack Bookstackapp | 4.3 | Nov 30 | bookstack is vulnerable to Improper Access Control |
| CVE-2021-3915 | BO Bookstack Bookstackapp | 5.7 | Nov 13 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
| CVE-2021-3916 | BO Bookstack Bookstackapp | 6.5 | Nov 5 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| CVE-2021-3906 | BO Bookstack Bookstackapp | 6.5 | Oct 27 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
| CVE-2021-3874 | BO Bookstack Bookstackapp | 6.5 | Oct 15 | bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| CVE-2021-3768 | BO Bookstack Bookstackapp | 5.4 | Sep 6 | bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| CVE-2021-3767 | BO Bookstack Bookstackapp | 5.4 | Sep 6 | bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| CVE-2021-3758 | BO Bookstack Bookstackapp | 6.5 | Sep 2 | bookstack is vulnerable to Server-Side Request Forgery (SSRF) |
| CVE-2020-26260 | BO Bookstack Bookstackapp | 6.4 | Dec 9 | BookStack is a platform for storing and organising information and documentation |
| CVE-2020-26211 | BO Bookstack Bookstackapp | 8.7 | Nov 3 | In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would… |
| CVE-2020-26210 | BO Bookstack Bookstackapp | 8.7 | Nov 3 | In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the… |
| CVE-2020-11055 | BO Bookstack Bookstackapp | 5.4 | May 7 | In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation |
| CVE-2020-5256 | BO Bookstack Bookstackapp | 8.8 | Mar 9 | BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system… |
| CVE-2017-1000462 | BO Bookstack Bookstackapp | 5.4 | Jan 3 | BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code |