Fabasoft vulnerabilities

Products

• cloud 1
• cloud enterprise client 1
• fabasoft cloud 1
• fabasoft cloud enterprise client 1
• Folio Client 1
• folio egov-suite 1

Latest Fabasoft CVEs

Newest publication first

1. CVE-2026-97155 Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions b...

   Published 2026-09-24

   Medium·CVSS 6.5 EPSS 0.11%

   Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was...

2. CVE-2023-32764 Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.

   Published 2023-08-03

   High·CVSS 7.8 EPSS 0.19%

   Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.

3. CVE-2022-29908 The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation.

   Published 2022-09-19

   High·CVSS 7.8 EPSS 0.23%

   The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation.

4. CVE-2014-7560 The Fabasoft Cloud (aka com.fabasoft.android.cmis.folio_cloud) application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv...

   Published 2014-10-20

   Medium·CVSS 5.4 EPSS 0.27%

   The Fabasoft Cloud (aka com.fabasoft.android.cmis.folio_cloud) application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.