Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

indico — Vulnerabilities & Security Advisories 15

All 15 CVE vulnerabilities found in indico, with AI-generated Chinese analysis, references, and POCs.

This page documents security weaknesses associated with indico, a web-based collaborative platform developed by CERN. It aggregates a comprehensive collection of vulnerabilities, primarily focusing on common categories such as cross-site scripting, SQL injection, and improper access control flaws. The data spans from the initial release of the software through to recent updates, ensuring coverage of historical and contemporary security issues found in various versions. Readers can utilize this resource to track the vendor's advisory history and observe how specific threats have been addressed over time. The interface allows users to understand the prevalence and impact of particular weakness classes within the indico ecosystem, providing context on how often certain types of errors occur in the codebase. Additionally, individuals can look up a specific product version's vulnerability history to assess risk exposure before upgrading or deploying the software in production environments. This centralization simplifies the process of monitoring security posture for administrators and developers relying on indico for their collaborative needs. By presenting vulnerabilities in an organized manner, the page facilitates informed decision-making regarding patch management and security hardening. Users seeking to analyze trends in software defects or compare security incidents across different releases will find this aggregation valuable for continuous improvement and threat mitigation strategies.

Vendor: indico

CVE ID Title CVSS Severity Published
CVE-2026-108388 Indico legacy contribution export cache poisoning discloses restricted metadata CWE-863 3.5 Low 2026-10-13
CVE-2026-107397 Indico: Cross-Site-Scripting in minutes editor CWE-79 4.4 Medium 2026-10-08
CVE-2026-107396 Indico: Cross-Site-Scripting in link fields CWE-692 5.4 Medium 2026-10-08
CVE-2026-107395 Indico: Missing access check in legacy session export API CWE-862 4.3 Medium 2026-10-08
CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check CWE-918 6.8 Medium 2026-10-08
CVE-2026-33046 Indico discloses local files resulting in Remote Code Execution through LaTeX injection CWE-78 9.8 - 2026-03-23
CVE-2026-28352 Indico missing access check in event series management API CWE-306 6.5 Medium 2026-02-27
CVE-2026-25739 Indico affected by Cross-Site-Scripting via material uploads CWE-79 5.4 Medium 2026-02-19
CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places CWE-367 7.5AI High AI 2026-02-19
CVE-2025-59035 Indico vulnerable to Cross-Site Scripting via LaTeX math code CWE-79 4.6 Medium 2025-09-10
CVE-2025-59034 Indico may disclose unauthorized user details access via legacy API CWE-639 4.3 Medium 2025-09-10
CVE-2025-53640 Indico vulnerable to user enumeration via API endpoint CWE-200 5.3AI Medium AI 2025-07-14
CVE-2024-50633 Indico 安全漏洞 CWE-201 - - 2025-01-16
CVE-2024-45399 Indico has a Cross-Site-Scripting during account creation CWE-79 4.3 Medium 2024-09-04
CVE-2023-37901 Cross-Site-Scripting via confirmation prompts CWE-79 5.4 Medium 2023-07-21

All 15 known CVE vulnerabilities affecting indico with full Chinese analysis, references, and POCs where available.