Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
electron vulnerabilities and exploits
(subscribe to this query)
8.8
CVSSv3
CVE-2023-42222
WebCatalog prior to 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
Webcatalog Webcatalog
1 Github repository
8.5
CVSSv3
CVE-2023-29198
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main world context in the...
Electronjs Electron
Electronjs Electron 25.0.0
Electronjs Electron 24.0.0
9.8
CVSSv3
CVE-2023-23623
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in re...
Electronjs Electron 23.0.0
Electronjs Electron 22.0.0
6.6
CVSSv3
CVE-2023-39956
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app...
Electronjs Electron
Electronjs Electron 26.0.0
7.5
CVSSv3
CVE-2022-48483
3CX prior to 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote malicious users to read %WINDIR%\system32 files via /Electron/download directory traversal in conjunction with a path component that has a drive letter and uses backslash characters. NOTE: this iss...
3cx 3cx
7.5
CVSSv3
CVE-2022-48482
3CX prior to 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote malicious users to read certain files via /Electron/download directory traversal. Files may have credentials, full backups, call recordings, and chat logs.
3cx 3cx
7.8
CVSSv3
CVE-2023-29059
3CX DesktopApp up to and including 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 of the 3CX DesktopApp Electron Windows application shipped in Update 7, and versions 18.11.1213, 18.12.402, 18.12.407, a...
3cx 3cx 18.12.407
3cx 3cx 18.12.416
3cx 3cx 18.12.402
3cx 3cx 18.11.1213
1 Github repository
7.8
CVSSv3
CVE-2023-1005
A vulnerability was found in JP1016 Markdown-Electron and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to code injection. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Cont...
Markdown-electron Project Markdown-electron -
9.8
CVSSv3
CVE-2022-25908
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
Create-choo-electron Project Create-choo-electron
7.5
CVSSv3
CVE-2022-41957
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara prior to 2.6.2 and from 3.0.0 and prior to 3.3.0, as well as all versions of muhammara's predecessor package hummus, are vulnerable to Denial of Service (...
Muhammara Project Muhammara
Hummus Project Hummus
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463
CVE-2024-29895
inject
CVE-2023-52689
CVE-2024-5049
CVE-2024-5051
privilege escalation
physical
CVE-2023-52676
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »