ghost vulnerabilities (npm)
73 vulnerabilities.
-
ghostnpm Ghost: Authorization Issue Allowed Author Role to Delete any Post 6.5 Medium -
ghostnpm Ghost: Stored XSS via SVG Uploads Bypassing Sanitization 7.3 High -
ghostnpm Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses 4.0 Medium -
ghostnpm Ghost: Server-Side Request Forgery in Bookmark Fetching 4.0 Medium -
ghostnpm Ghost: Regular Expression Denial of Service in Content Import 4.9 Medium -
ghostnpm Ghost: Regular Expression Denial of Service in External Media Inliner 4.9 Medium -
ghostnpm Ghost: Stored XSS via SVG Files in Content Imports 6.8 Medium -
ghostnpm Ghost: Stored XSS via Embed Card Previews 7.3 High -
ghostnpm Ghost: Remote Code Execution via Bookmark Card Images 8.8 High -
ghostnpm Ghost: Remote Code Execution via Theme Translation Files 7.2 High -
ghostnpm Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files 8.6 High -
ghostnpm Ghost: Path Traversal via Locale Setting 4.9 Medium -
ghostnpm Ghost: Invite Token Disclosure in Ghost Admin API 7.5 High -
ghostnpm Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting 6.9 Medium -
ghostnpm Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API 7.7 High -
ghostnpm Ghost: Password Hash Ordering Disclosure in Ghost Admin API 3.1 Low -
ghostnpm Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API 2.3 Low -
ghostnpm Ghost: Stored XSS via oEmbed Photo Responses 8.1 High -
ghostnpm Ghost: Stored XSS via Bookmark Card Images 7.3 High -
ghostnpm Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses 8.6 High -
ghostnpm Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images 8.5 High -
ghostnpm Ghost: Editors Could Promote Staff Users to Their Own Role 4.3 Medium -
ghostnpm Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment 5.3 Medium -
ghostnpm Ghost: Stored XSS via File Uploads on Local Storage 7.3 High -
ghostnpm Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads 8.5 High -
ghostnpm Ghost: Path Traversal Vulnerability in Ghost ImageSize Service 3.8 Low -
ghostnpm Ghost: Authorization Bypass in Comments Feature 6.5 Medium -
ghostnpm Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize 5.1 Medium -
ghostnpm Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments 7.1 High -
ghostnpm Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like 7.1 High -
ghostnpm Ghost: Server-Side Request Forgery in Webhook Trigger 2.7 Low -
ghostnpm Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook 5.1 Medium -
ghostnpm Ghost: Cross-Site Scripting in Feature Image Captions 4.3 Medium -
ghostnpm Ghost: Server-Side Request Forgery Mitigation Issue 4.0 Medium -
ghostnpm Ghost: Session Fixation in Ghost Admin 6.7 Medium -
ghostnpm Ghost: Theme Upload Path Traversal 6.6 Medium -
ghostnpm Ghost: Database Backup Path Traversal 5.5 Medium -
ghostnpm Ghost: Server-Side Request Forgery in Image Fetching 4.1 Medium -
ghostnpm Ghost: Blind Password Hash Disclosure in Ghost Admin API 4.8 Medium -
ghostnpm Ghost: Archived Offers can be Redeemed 4.8 Medium -
ghostnpm Ghost: Cross-Site Scripting in Universal Import 5.0 Medium -
ghostnpm Ghost: Paid gift memberships obtainable at minimal cost via the donations feature 5.3 Medium -
ghostnpm Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header 9.6 Critical -
ghostnpm Ghost: Private IP filtering bypass to make server-side requests to internal services 5.8 Medium -
ghostnpm Ghost: Server-side request forgery via DNS rebinding in external request handling 4.0 Medium -
ghostnpm Ghost: Mobiledoc image-size fetch SSRF 5.4 Medium -
ghostnpm Ghost: Member existence leak via magic link sign-in response 5.3 Medium -
ghostnpm Ghost: File Upload Content-Type Spoofing 5.4 Medium -
ghostnpm Ghost Content API filter bypass reveals private fields 5.3 Medium -
ghostnpm Ghost: Incomplete CSRF protections around OTC use 7.5 High - Show olderLoading…