OpenSlides vulnerabilities

Products

• OpenSlides 8

Latest OpenSlides CVEs

Newest publication first

1. CVE-2026-25519 OpenSlides has incorrect access control vulnerability in authentication service

   Published 2026-02-04

   Critical·CVSS 9.8 EPSS 0.55%

   OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to version 4.2.29, OpenSlides supports local logins with username and password or an optionally configurable single sign on with SAML v...

2. CVE-2025-30345 An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are fi...

   Published 2025-03-21

   Medium·CVSS 4.1 EPSS 0.29%

   An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properl...

3. CVE-2025-30343 A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that....

   Published 2025-03-21

   Medium·CVSS 6.5 EPSS 0.48%

   A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the...

4. CVE-2025-30344 An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a user exists in the system. The timing di...

   Published 2025-03-21

   Low·CVSS 3.7 EPSS 0.32%

   An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a user exists in the system. The timing discrepancy stems from the omitted hashing of the password (e.g., more than 100 mi...

5. CVE-2025-30342 An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This all...

   Published 2025-03-21

   Medium·CVSS 6.1 EPSS 0.26%

   An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element,...

6. CVE-2024-22892 OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.

   Published 2024-09-25

   High·CVSS 7.5 EPSS 0.25%

   OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.

7. CVE-2024-22893 OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain information about the password hash using a timing...

   Published 2024-09-25

   High·CVSS 7.5 EPSS 0.36%

   OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain information about the password hash using a timing attack.

8. CVE-2020-26280 XSS in OpenSlides

   Published 2020-12-18

   High·CVSS 8.9 EPSS 1.4%

   OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting (XSS). In...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.