scrypted @scrypted/server vulnerabilities

Latest scrypted @scrypted/server CVEs

Newest publication first

1. GHSA-w4hv-vmv9-hgcr GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`

   Published 2024-02-16

   High·CVSS 8.3

   GitHub Security Lab (GHSL) Vulnerability Report, scrypted: GHSL-2023-218, GHSL-2023-219 The GitHub Security Lab team has identified potential security vulnerabilities in scrypted. We are committed to working with you to help resolve these issues. In this report you will find ever...

2. CVE-2023-47620 Scrypted reflected Cross-site Scripting vulnerability

   Published 2023-12-13

   Medium·CVSS 6.1

   Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the owner' and 'pkg parameters. An attacker can run arbitrary JavaScript code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.