Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2025-48955

Para Server Logs Sensitive Information

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Erudika
Products
Para
CVE-2025-49009

Para Inserts Sensitive Information into Log File for Facebook authentication

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Erudika
Products
Para
CVE-2022-1848

Business Logic Errors in erudika/para

Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Erudika
Products
Para
CVE-2022-1782

Cross-site Scripting (XSS) - Generic in erudika/para

Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Erudika
Products
Para