Skip to content
Erudika vulnerabilities
Newest
-
erudika scoold
Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and Logs
CVE-2026-57183
6.1 Medium
-
erudika scoold
Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass
CVE-2026-55840
5.4 Medium
-
erudika scoold
Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain
CVE-2026-55842
5.4 Medium
-
erudika scoold
Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled
CVE-2026-54676
6.5 Medium
-
erudika scoold
Scoold: Authenticated user can post replies and comments to private-space questions without space membership
CVE-2026-54677
6.5 Medium
-
erudika scoold
Scoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation)
CVE-2026-42176
6.7 Medium
-
erudika scoold
Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask
CVE-2026-39354
6.5 Medium
-
erudika scoold
Scoold: Cross-Account Feedback Deletion (IDOR)
CVE-2026-34832
6.5 Medium
-
erudika para
Para Inserts Sensitive Information into Log File for Facebook authentication
CVE-2025-49009
Fix available
6.2 Medium
-
erudika para
Para Server Logs Sensitive Information
CVE-2025-48955
Fix available
6.2 Medium
-
erudika scoold
Semicolon Path Injection on API /api;/config
CVE-2024-50334
8.7 High
-
erudika erudika/para, para +1 more
Business Logic Errors in erudika/para
CVE-2022-1848
Fix available
9.0 Critical
-
erudika erudika/para, para +1 more
Cross-site Scripting (XSS) - Generic in erudika/para
CVE-2022-1782
Fix available
9.4 Critical
-
erudika erudika/scoold, scoold +1 more
Improper handling of Length parameter in erudika/scoold
CVE-2022-1543
9.3 Critical
-
erudika scoold
Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown...
CVE-2021-46372
5.4 Medium