GCVE - cpe:2.3:a:if-me:ifme:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:if-me:ifme:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	If Me (`ffc77c44-5b76-5d12-8312-585f7f208615`)
Product	Ifme (`8fd6b715-5b8c-55d8-a91e-66a09ba6e9e2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/ifmeorg/ifme`	purl2cpe	2026-06-01 10:12:06.205317

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-25992`	vulnerable	2026-06-08 05:30:41.839820	ifme - Insufficient Session Expiration CRITICAL (9.8) In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks. Published: 2022-02-10T09:55:09.803Z Updated: 2024-09-16T16:53:23.213Z Open on db.gcve.eu Reference links https://github.com/ifmeorg/ifme/commit/014f6d3526a594109d4d6607c2f30b1865e37611 https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25992	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25991`	vulnerable	2026-06-08 05:30:41.839450	ifme - Improper Access Control leads to admin deactivation MEDIUM (5.7) In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme. Published: 2021-12-29T09:10:19.040Z Updated: 2025-04-30T15:43:44.984Z Open on db.gcve.eu Reference links https://github.com/ifmeorg/ifme/commit/d1f570c458d41667df801fc9c40a18b181a2d923 https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25991	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25990`	vulnerable	2026-06-08 05:30:41.838907	ifme - Stored Cross-Site Scripting (XSS) in Contacts section MEDIUM (5.4) In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe. Published: 2021-12-29T09:10:17.689Z Updated: 2025-04-30T15:43:55.017Z Open on db.gcve.eu Reference links https://github.com/ifmeorg/ifme/commit/83fd44ef8921a8dcf394a012e44901ab08596bdc https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25990	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25989`	vulnerable	2026-06-08 05:30:41.838367	ifme - Stored Cross-Site Scripting (XSS) in Groups section MEDIUM (5.4) In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them. Published: 2021-12-29T09:10:16.335Z Updated: 2025-04-30T15:44:01.727Z Open on db.gcve.eu Reference links https://github.com/ifmeorg/ifme/commit/df4986f0721a72779403d21d36c025fe95edffad https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25989	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25988`	vulnerable	2026-06-08 05:30:41.837609	ifme - Stored Cross-Site Scripting (XSS) in Notifications section MEDIUM (5.4) In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin. Published: 2021-12-29T09:10:14.710Z Updated: 2025-04-30T15:44:07.124Z Open on db.gcve.eu Reference links https://github.com/ifmeorg/ifme/commit/720a47015e46ad387b3219fed7ebfb14ec3c854c https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25988	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.