Hallo Welt! GmbH BlueSpice

• CVE-2026-25784 Critical 9.8 bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop 0.3%
• CVE-2026-25716 High 7.1 BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users 0.2%
• CVE-2026-24732 Medium 6.6 Improper permission checks in Extension:NSFileRepo 0.3%
• CVE-2025-58114 Medium 5.9 Potential XSS in Extension:CognitiveProcessDesigner 0.2%
• CVE-2025-57880 Medium 5.9 Potential XSS in Extension:BlueSpiceWhoIsOnline 0.2%
• CVE-2025-48007 Medium 5.9 Potential XSS in Extension:BlueSpiceAvatars 0.2%
• CVE-2025-46703 Medium 5.9 Potential XSS in Extension:AtMentions 0.2%
• CVE-2023-42431 Low 2.1 Potential XSS on user preferences page 0.4%
• CVE-2022-42001 Low 3.3 Potential XSS in book navigation 0.3%
• CVE-2022-42000 Low 3.3 Potential XSS in comment section 0.3%
• CVE-2022-41814 Low 3.3 Potential XSS in history view 0.3%
• CVE-2022-41789 Low 3.3 Potential XSS on default page header 0.3%
• CVE-2022-41611 Low 2.3 Potential XSS on sidebar navigation 0.3%
• CVE-2022-3958 Low 3.3 Potential XSS on personal menu navigation 0.3%
• CVE-2022-3893 Low 2.3 Potential XSS on custom menu navigation 0.3%
• CVE-2022-2510 Medium 4.3 Potential XSS on Special:SearchCenter 0.5%
• CVE-2022-2511 Medium 4.3 Potential XSS in title URL parameter 0.5%