Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-54461

Habitica: Regex Injection / ReDoS in Member Search

Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Habitica
Products
Habitica
CVE-2024-53272

GHSL-2024-109: Reflected XSS in /login in habitica

Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch.

CVSS 4.0 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Habitica
Products
Habitica
CVE-2024-53273

GHSL-2024-110: Reflected XSS in /register in habitica

Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `RegisterLoginReset.vue` contains a reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch.

CVSS 4.0 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Habitica
Products
Habitica
CVE-2024-53274

GHSL-2024-111: Reflected XSS in /home in habitica

Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability. Arbitrary javascript can be executed by the attacker in the context of the victim’s session. Version 5.28.5 contains a patch.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Habitica
Products
Habitica
CVE-2022-23078

Habitica - Open redirect in login page

In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.

CVSS 2.0 · 5.8 Medium EPSS 1.2% KEV · Not listed
Vendors
Habitica
Products
Habitica
CVE-2022-23077

Habitica - DOM XSS in login page

In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Habitica
Products
Habitica