Skip to content

Vendor

droppy project vulnerabilities

2 published CVES affecting droppy project, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of droppy project alerts

Products

Latest droppy project CVEs

Newest publication first

  1. CVE-2020-7757 Path Traversal

    Published
    MediumCVSS 6.5 EPSS 1.6%

    This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.

  2. CVE-2016-10529 No CSRF Validation in droppy

    Published
    HighCVSS 8.8 EPSS 0.48%

    Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.