Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

BlueSpice — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in BlueSpice, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses affecting BlueSpice, a wiki software extension developed by the BlueSpice vendor, categorized under various vulnerability types and tagged for easy filtering. The collection encompasses a wide spectrum of issues ranging from cross-site scripting and SQL injection to improper access control and code execution flaws, covering the product's entire public vulnerability history from its initial release to the present day. Users can leverage this resource to track official vendor advisories for timely patching, analyze the prevalence and impact of specific weakness classes within the BlueSpice ecosystem, or review the complete vulnerability timeline to assess the long-term security posture of their installations. By centralizing these critical data points, the page serves as a factual reference for security professionals, system administrators, and developers who need to understand the historical security context of BlueSpice without navigating fragmented sources. The information presented here is derived from public disclosures and verified reports, ensuring that readers have access to accurate and up-to-date details regarding the software's security landscape. This compilation aims to support proactive risk management and informed decision-making for organizations relying on BlueSpice for their collaborative documentation needs.

Vendor: Hallo Welt! GmbH

CVE ID Title CVSS Severity Published
CVE-2026-25784 bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop CWE-1188 9.8 Critical 2026-10-23
CVE-2026-25716 BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users CWE-862 7.1 High 2026-10-23
CVE-2026-24732 Improper permission checks in Extension:NSFileRepo CWE-552 6.5AI Medium AI 2026-03-04
CVE-2025-58114 Potential XSS in Extension:CognitiveProcessDesigner CWE-20 6.1 - 2025-09-19
CVE-2025-57880 Potential XSS in Extension:BlueSpiceWhoIsOnline CWE-116 6.1 - 2025-09-19
CVE-2025-48007 Potential XSS in Extension:BlueSpiceAvatars CWE-116 6.1 - 2025-09-19
CVE-2025-46703 Potential XSS in Extension:AtMentions CWE-116 6.1 - 2025-09-19
CVE-2023-42431 Potential XSS on user preferences page CWE-20 2.1 Low 2023-10-30
CVE-2022-42001 Potential XSS in book navigation CWE-79 3.3 Low 2022-11-15
CVE-2022-42000 Potential XSS in comment section CWE-79 3.3 Low 2022-11-15
CVE-2022-41814 Potential XSS in history view CWE-79 3.3 Low 2022-11-15
CVE-2022-41789 Potential XSS on default page header CWE-79 3.3 Low 2022-11-15
CVE-2022-41611 Potential XSS on sidebar navigation CWE-79 2.3 Low 2022-11-15
CVE-2022-3958 Potential XSS on personal menu navigation CWE-79 3.3 Low 2022-11-15
CVE-2022-3893 Potential XSS on custom menu navigation CWE-79 2.3 Low 2022-11-15
CVE-2022-2510 Potential XSS on Special:SearchCenter CWE-79 4.3 Medium 2022-07-22
CVE-2022-2511 Potential XSS in title URL parameter CWE-79 4.3 Medium 2022-07-22

All 17 known CVE vulnerabilities affecting BlueSpice with full Chinese analysis, references, and POCs where available.