Approved changes feed: RSS · Atom
cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Appwrite (4dbbc8dd-e8f5-5899-84e8-2824528b019b) |
|---|---|
| Product | Appwrite (ef141bf3-1c0e-5b12-9932-9c34a43d19d8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/appwrite/appwrite |
purl2cpe | 2026-06-01 10:16:06.866893 |
pkg:github/appwrite/appwrite |
purl2cpe | 2026-06-01 10:16:06.866894 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-1063 |
vulnerable | 2026-06-08 06:25:39.139982 |
Details available
MEDIUM (5.3)
Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.
Published: 2024-01-30T09:20:26.210Z
Updated: 2025-05-29T15:05:40.384Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-27159 |
vulnerable | 2026-06-08 05:57:40.684391 |
Details available
Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.
Published: 2023-03-31T00:00:00.000Z
Updated: 2026-07-09T00:24:27.951Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2925 |
vulnerable | 2026-06-08 05:43:36.723729 |
Cross-site Scripting (XSS) - Stored in appwrite/appwrite
CRITICAL (9)
Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.
Published: 2022-09-09T05:25:09.000Z
Updated: 2024-08-03T00:52:59.827Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25377 |
vulnerable | 2026-06-08 05:41:45.881740 |
Details available
The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)
Published: 2024-02-22T00:00:00.000Z
Updated: 2024-08-21T17:46:27.441Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-23682 |
vulnerable | 2026-06-08 05:30:03.043970 |
Prototype Pollution
HIGH (7.3)
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
Published: 2022-02-16T17:05:26.116Z
Updated: 2024-09-16T20:17:30.120Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.