Skip to content

Vendor

indico vulnerabilities

14 published CVES affecting indico, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
14
Critical
0
High
1
Medium
12
Low
1
Unscored
0
CISA KEV
0
Atom feed of indico alerts

Products

Latest indico CVEs

Newest publication first

  2. CVE-2026-107397 Indico: Cross-Site-Scripting in minutes editor

    Published
    MediumCVSS 4.4 EPSS 0.23%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to th...

  3. CVE-2026-107396 Indico: Cross-Site-Scripting in link fields

    Published
    MediumCVSS 5.4 EPSS 0.19%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept cus...

  4. CVE-2026-107395 Indico: Missing access check in legacy session export API

    Published
    MediumCVSS 4.3 EPSS 0.24%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as...

  5. CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check

    Published
    MediumCVSS 6.8 EPSS 0.34%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local...

  7. CVE-2026-28352 Indico missing access check in event series management API

    Published
    MediumCVSS 6.5 EPSS 0.30%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. Th...

  8. CVE-2026-25739 Indico affected by Cross-Site-Scripting via material uploads

    Published
    MediumCVSS 5.4 EPSS 0.19%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cross-site scripting when uploading certain file types as materials. Users should upgrade to version 3.3.10 to receive a pat...

  9. CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places

    Published
    MediumCVSS 6.9 EPSS 0.27%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentio...

  10. CVE-2025-59035 Indico vulnerable to Cross-Site Scripting via LaTeX math code

    Published
    MediumCVSS 5.4 EPSS 0.21%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update t...

  12. CVE-2025-53640 Indico vulnerable to user enumeration via API endpoint

    Published
    MediumCVSS 5.3 EPSS 0.66%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic...

  13. CVE-2024-45399 Indico has a Cross-Site-Scripting during account creation

    Published
    MediumCVSS 6.1 EPSS 0.38%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version 3.3.4, corresponding to Flask-Multipass prior to version 0.5.5, there is a Cross-Site-Scripting vulnerability during account creation when r...

  14. CVE-2023-37901 Cross-Site-Scripting via confirmation prompts

    Published
    MediumCVSS 5.4 EPSS 0.52%

    Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges (such as a speaker...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.