Approved changes feed: RSS · Atom
cpe:2.3:a:ifmeorg:ifme:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Ifmeorg (8b99fe7c-4c07-5617-b292-44c89cbde735) |
|---|---|
| Product | Ifme (b9c9f57b-c9b7-503d-a651-5a421e050fce) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-25992 |
vulnerable | 2026-06-08 05:30:41.839786 |
ifme - Insufficient Session Expiration
CRITICAL (9.8)
In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.
Published: 2022-02-10T09:55:09.803Z
Updated: 2024-09-16T16:53:23.213Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25991 |
vulnerable | 2026-06-08 05:30:41.839408 |
ifme - Improper Access Control leads to admin deactivation
MEDIUM (5.7)
In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.
Published: 2021-12-29T09:10:19.040Z
Updated: 2025-04-30T15:43:44.984Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25990 |
vulnerable | 2026-06-08 05:30:41.838873 |
ifme - Stored Cross-Site Scripting (XSS) in Contacts section
MEDIUM (5.4)
In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.
Published: 2021-12-29T09:10:17.689Z
Updated: 2025-04-30T15:43:55.017Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25989 |
vulnerable | 2026-06-08 05:30:41.838321 |
ifme - Stored Cross-Site Scripting (XSS) in Groups section
MEDIUM (5.4)
In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.
Published: 2021-12-29T09:10:16.335Z
Updated: 2025-04-30T15:44:01.727Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25988 |
vulnerable | 2026-06-08 05:30:41.836776 |
ifme - Stored Cross-Site Scripting (XSS) in Notifications section
MEDIUM (5.4)
In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.
Published: 2021-12-29T09:10:14.710Z
Updated: 2025-04-30T15:44:07.124Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.