| CVE-2026-86507 |
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted…
|
6.1
Medium
|
Sep 28, 2026 |
| CVE-2026-82379 |
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest…
|
7.7
High
|
Sep 28, 2026 |
| CVE-2026-82380 |
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform…
|
8.1
High
|
Sep 28, 2026 |
| CVE-2026-82381 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
|
5.4
Medium
|
Sep 28, 2026 |
| CVE-2026-82382 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
|
6.1
Medium
|
Sep 28, 2026 |
| CVE-2026-82383 |
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to…
|
8.2
High
|
Sep 28, 2026 |
| CVE-2026-82384 |
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause…
|
9.8
Critical
|
Sep 28, 2026 |
| CVE-2026-82375 |
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a…
|
7.4
High
|
Sep 28, 2026 |
| CVE-2026-82376 |
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights…
|
7.7
High
|
Sep 28, 2026 |
| CVE-2026-82377 |
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content…
|
9.9
Critical
|
Sep 28, 2026 |
| CVE-2026-82378 |
Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote…
|
9.0
Critical
|
Sep 28, 2026 |
| CVE-2026-82385 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to…
|
6.5
Medium
|
Sep 28, 2026 |
| CVE-2026-82386 |
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files…
|
7.7
High
|
Sep 28, 2026 |
| CVE-2026-82348 |
Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring…
|
7.7
High
|
Sep 28, 2026 |
| CVE-2026-82387 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
|
5.4
Medium
|
Sep 28, 2026 |
| CVE-2026-82546 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an…
|
6.1
Medium
|
Sep 28, 2026 |
| CVE-2026-91204 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an…
|
6.1
Medium
|
Sep 28, 2026 |
| CVE-2026-91206 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
|
6.1
Medium
|
Sep 28, 2026 |
| CVE-2025-24859 |
A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not…
|
2.1
Low
|
Apr 14, 2025 |
| CVE-2024-46911 |
Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller
|
Not rated
|
Oct 14, 2024 |
| CVE-2024-25090 |
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name…
|
Not rated
|
Jul 26, 2024 |
| CVE-2023-37581 |
Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all…
|
Not rated
|
Aug 6, 2023 |
| CVE-2021-33580 |
User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to…
|
Not rated
|
Aug 18, 2021 |
| CVE-2018-17198 |
Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier…
|
Not rated
|
May 28, 2019 |