Vulnerabilities
6 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-28097 +1 in the same advisory: …28096 | OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers. OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers. NVD description · AI analysis pending | 5.5 group max | <1% | PoC |
| — | |
| CVE-2023-7210 | A vulnerability was found in OneNav up to 0.9.33. A vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=api of the component API. The manipulation of the argument X-Token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249765 was assigned to this vulnerability. NVD description · AI analysis pending | 9.8 | <1% |
| — | ||
| CVE-2022-26276 | An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal. An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal. NVD description · AI analysis pending | 5.3 | 1% |
| — | ||
| CVE-2021-38712 | OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. NOTE: the vendor's recommended solution is to block the access via an NGINX configuration file. NVD description · AI analysis pending | 7.5 | 1% | PoC |
| — | |
| CVE-2021-38138 | OneNav beta 0.9.12 allows XSS via the Add Link feature. OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release. NVD description · AI analysis pending | 5.4 | 2% | PoC ×2 |
| — |