Beego

Beego

12 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.6

CVE-2025-30223

Exploit
  • EPSS 0.34%
  • Veröffentlicht 31.03.2025 17:15:42
  • Zuletzt bearbeitet 01.08.2025 18:58:43

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows...

7.5

CVE-2024-55885

  • EPSS 0.17%
  • Veröffentlicht 12.12.2024 20:15:21
  • Zuletzt bearbeitet 01.08.2025 20:18:29

beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Ve...

8.8

CVE-2024-40464

  • EPSS 0.75%
  • Veröffentlicht 31.07.2024 21:15:17
  • Zuletzt bearbeitet 15.08.2024 13:02:33

An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file

8.8

CVE-2024-40465

  • EPSS 0.44%
  • Veröffentlicht 31.07.2024 21:15:17
  • Zuletzt bearbeitet 15.08.2024 13:11:07

An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file

9.8

CVE-2022-31836

Exploit
  • EPSS 0.45%
  • Veröffentlicht 05.07.2022 15:15:08
  • Zuletzt bearbeitet 21.11.2024 07:05:23

The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.

9.8

CVE-2022-31259

Exploit
  • EPSS 0.15%
  • Veröffentlicht 21.05.2022 19:15:52
  • Zuletzt bearbeitet 21.11.2024 07:04:14

The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).

9.8

CVE-2021-30080

  • EPSS 0.43%
  • Veröffentlicht 05.04.2022 16:15:12
  • Zuletzt bearbeitet 21.11.2024 06:03:18

An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.

7.8

CVE-2021-27116

Exploit
  • EPSS 0.16%
  • Veröffentlicht 05.04.2022 16:15:11
  • Zuletzt bearbeitet 21.11.2024 05:57:22

An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.

7.8

CVE-2021-27117

Exploit
  • EPSS 0.16%
  • Veröffentlicht 05.04.2022 16:15:11
  • Zuletzt bearbeitet 21.11.2024 05:57:22

An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.

6.1

CVE-2021-39391

Exploit
  • EPSS 0.24%
  • Veröffentlicht 14.09.2021 18:15:08
  • Zuletzt bearbeitet 21.11.2024 06:19:28

Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.