Approved changes feed: RSS · Atom
cpe:2.3:a:habitrpg:habatica:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Habitrpg (fb120748-7a60-59c2-b7b9-020ec9ae4ec1) |
|---|---|
| Product | Habatica (7a95afc0-d0bd-5d46-9451-18c26b7275d4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-53274 |
vulnerable | 2026-06-08 06:54:14.895725 |
GHSL-2024-111: Reflected XSS in /home in habitica
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability. Arbitrary javascript can be executed by the attacker in the context of the victim’s session. Version 5.28.5 contains a patch.
Published: 2024-12-11T22:16:31.855Z
Updated: 2024-12-12T15:54:17.865Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53273 |
vulnerable | 2026-06-08 06:54:14.895216 |
GHSL-2024-110: Reflected XSS in /register in habitica
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `RegisterLoginReset.vue` contains a reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch.
Published: 2024-12-11T22:13:44.876Z
Updated: 2024-12-12T15:55:37.199Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53272 |
vulnerable | 2026-06-08 06:54:14.893734 |
GHSL-2024-109: Reflected XSS in /login in habitica
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch.
Published: 2024-12-11T22:06:56.331Z
Updated: 2024-12-12T16:00:45.275Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.