Approved changes feed: RSS · Atom
cpe:2.3:a:habitica:habitica:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Habitica (6cf2be94-a2ab-529a-9a9d-e00effa1d057) |
|---|---|
| Product | Habitica (aa8fedd0-375a-55da-b3e8-acc580f2939e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/habitrpg/habitica |
purl2cpe | 2026-06-01 10:12:46.798874 |
pkg:sourceforge/habitica.mirror |
purl2cpe | 2026-06-01 10:12:46.798875 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-53274 |
vulnerable | 2026-06-08 06:54:14.895871 |
GHSL-2024-111: Reflected XSS in /home in habitica
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability. Arbitrary javascript can be executed by the attacker in the context of the victim’s session. Version 5.28.5 contains a patch.
Published: 2024-12-11T22:16:31.855Z
Updated: 2024-12-12T15:54:17.865Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53273 |
vulnerable | 2026-06-08 06:54:14.895258 |
GHSL-2024-110: Reflected XSS in /register in habitica
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `RegisterLoginReset.vue` contains a reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch.
Published: 2024-12-11T22:13:44.876Z
Updated: 2024-12-12T15:55:37.199Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53272 |
vulnerable | 2026-06-08 06:54:14.894779 |
GHSL-2024-109: Reflected XSS in /login in habitica
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch.
Published: 2024-12-11T22:06:56.331Z
Updated: 2024-12-12T16:00:45.275Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23078 |
vulnerable | 2026-06-08 05:40:56.151291 |
Habitica - Open redirect in login page
In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.
Published: 2022-06-22T12:00:17.050Z
Updated: 2024-09-17T02:15:32.574Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23077 |
vulnerable | 2026-06-08 05:40:56.150896 |
Habitica - DOM XSS in login page
In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.
Published: 2022-06-22T11:30:16.489Z
Updated: 2024-09-17T02:16:28.576Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.