Freshrss vulnerabilities

Products

• Freshrss 23

Newest

• freshrss FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch] CVE-2025-68402 8.2 HighMarch 9, 2026
• freshrss FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens CVE-2025-62166 7.5 HighMarch 9, 2026
• freshrss FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After CVE-2025-68148 4.3 MediumDecember 26, 2025
• freshrss FreshRSS has weak cryptographic randomness in remember-me token and nonce generation CVE-2025-68932 2.9 LowDecember 26, 2025
• freshrss FreshRSS has Logout CSRF that Leads to DoS via <track src> CVE-2025-59949 5.3 MediumDecember 18, 2025
• freshrss FreshRSS vulnerable to authenticated RCE via path traversal inside include() CVE-2025-58173 7.4 HighDecember 15, 2025
• freshrss FreshRSS: Double clickjacking can lead to privilege escalation CVE-2025-59950 6.7 MediumSeptember 29, 2025
• freshrss FreshRSS is vulnerable to directory enumeration by setting path in its theme field CVE-2025-61586 6.9 MediumSeptember 29, 2025
• freshrss FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page CVE-2025-59948 6.7 MediumSeptember 29, 2025
• freshrss FressRSS: Clickjacking can lead to XSS and/or privilege escalation CVE-2025-57769 5.3 MediumSeptember 29, 2025
• freshrss FreshRSS: Unauthorized creation of admin user when registration is enabled CVE-2025-54875 9.8 CriticalSeptember 29, 2025
• freshrss FreshRSS has Incomplete Session Termination on Logout CVE-2025-54592 8.8 HighSeptember 29, 2025
• freshrss FreshRSS: Unauthenticated users can view default user's information CVE-2025-54591 7.5 HighSeptember 29, 2025
• freshrss FreshRSS is vulnerable to RCE attacks by authenticated admin CVE-2025-54593 7.2 HighAugust 1, 2025
• freshrss Privilege escalation via SSRF when using HTTP auth CVE-2025-46341 7.1 HighJune 4, 2025
• freshrss FreshRSS vulnerable to favicon cache poisoning via proxy CVE-2025-46339 4.3 MediumJune 4, 2025
• freshrss FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc> CVE-2025-32015 6.7 MediumJune 4, 2025
• freshrss FreshRSS vulnerable to DoS by malicious feed entry loading logout URL CVE-2025-31482 4.3 MediumJune 4, 2025
• freshrss FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entry CVE-2025-31136 6.7 MediumJune 4, 2025
• freshrss FreshRSS vulnerable to directory enumeration via ext.php CVE-2025-31134 5.5 MediumJune 4, 2025
• freshrss Sensitive information exposure in the logs of greader API in FreshRSS CVE-2023-22481 4.0 MediumMarch 6, 2023
• freshrss Insecure file access in FreshRSS CVE-2022-23497 6.5 MediumDecember 9, 2022
• freshrss Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow... CVE-2018-19782 Public exploit 6.1 MediumJanuary 29, 2019