Plantuml
by Plantuml
Source repositories
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-0858 | Med | 0.33 | 6.1 | 0.00 | Jan 16, 2026 | Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG… | ||
| CVE-2023-3432 | 0.00 | — | 0.01 | Jun 27, 2023 | Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9. | |||
| CVE-2023-3431 | 0.00 | — | 0.01 | Jun 27, 2023 | Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9. | |||
| CVE-2020-36523 | 0.00 | — | 0.01 | Jun 3, 2022 | A vulnerability was found in PlantUML 6.43. It has been declared as problematic. Affected by this vulnerability is the component Database Information Macro. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the… | |||
| CVE-2022-1379 | 0.00 | — | 0.02 | May 14, 2022 | URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal… | |||
| CVE-2022-1231 | 0.00 | — | 0.02 | Apr 15, 2022 | XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example… |
- risk 0.33cvss 6.1epss 0.00
Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG…
- CVE-2023-3432Jun 27, 2023risk 0.00cvss —epss 0.01
Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.
- CVE-2023-3431Jun 27, 2023risk 0.00cvss —epss 0.01
Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.
- CVE-2020-36523Jun 3, 2022risk 0.00cvss —epss 0.01
A vulnerability was found in PlantUML 6.43. It has been declared as problematic. Affected by this vulnerability is the component Database Information Macro. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the…
- CVE-2022-1379May 14, 2022risk 0.00cvss —epss 0.02
URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal…
- CVE-2022-1231Apr 15, 2022risk 0.00cvss —epss 0.02
XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example…