Skip to contentErudika Scoold vulnerabilities
- erudika scooldScoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and LogsCVE-2026-571836.1 Medium
- erudika scooldScoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypassCVE-2026-558405.4 Medium
- erudika scooldScoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domainCVE-2026-558425.4 Medium
- erudika scooldScoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabledCVE-2026-546766.5 Medium
- erudika scooldScoold: Authenticated user can post replies and comments to private-space questions without space membershipCVE-2026-546776.5 Medium
- erudika scooldScoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation)CVE-2026-421766.7 Medium
- erudika scooldScoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/askCVE-2026-393546.5 Medium
- erudika scooldScoold: Cross-Account Feedback Deletion (IDOR)CVE-2026-348326.5 Medium
- erudika scooldSemicolon Path Injection on API /api;/configCVE-2024-503348.7 High
- erudika erudika/scoold, scoold +1 moreImproper handling of Length parameter in erudika/scooldCVE-2022-15439.3 Critical
- erudika scooldScoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown...CVE-2021-463725.4 Medium