cve.bz

nuxsmin syspass vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 9.3CVE-2026-129110

    sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Atta…

  2. 8.6CVE-2026-63725EPSS 0.4%

    sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf …

  3. 8.6CVE-2026-65711EPSS 2.0%

    sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup.…

  4. 7.1CVE-2026-65710EPSS 0.3%

    sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINK_CREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password…

  5. 8.7CVE-2026-65709EPSS 0.4%

    sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault wi…

  6. 8.6CVE-2026-65708EPSS 0.4%

    sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting mi…