All 7 CVE vulnerabilities found in countly-server, with AI-generated Chinese analysis, references, and POCs.
Vendor: Countly
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-44977 | countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context CWE-79 | 9.0 | Critical | 2026-10-16 |
| CVE-2026-41582 | countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files CWE-22 | 7.5 | High | 2026-10-16 |
| CVE-2026-42270 | countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception CWE-248 | 7.5 | High | 2026-10-16 |
| CVE-2026-42269 | countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion CWE-22 | 8.1 | High | 2026-10-16 |
| CVE-2026-87803 | Countly 授权问题漏洞 CWE-863 | 7.1 | High | 2026-09-10 |
| CVE-2021-32852 | countly-server vulnerable to Cross-site Scripting CWE-79 | 5.4 | Medium | 2023-02-20 |
| CVE-2022-29174 | Predictable password reset token may lead to account takeover in countly-server CWE-640 | 8.1 | High | 2022-05-17 |
All 7 known CVE vulnerabilities affecting countly-server with full Chinese analysis, references, and POCs where available.