gladysassistant vulnerabilities

Products

• gladys assistant 3
• gladysassistant/gladys 1

Latest gladysassistant CVEs

Newest publication first

1. CVE-2026-93340 Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

   Published 2026-09-21

   High·CVSS 7.4 EPSS 0.53%

   Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without serve...

2. CVE-2024-47210 Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js.

   Published 2024-09-21

   High·CVSS 8.8 EPSS 0.58%

   Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js.

3. CVE-2023-47440 Directory Traversal in Gladys Assistant

   Published 2023-12-07

   Medium·CVSS 6.5 EPSS 1.0%

   Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine.

4. CVE-2023-43256 A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input.

   Published 2023-09-25

   Medium·CVSS 6.5 EPSS 0.84%

   A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.