HabitRPG
Products
1- 6 CVEs
Recent CVEs
6| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-23077 | Med | 0.40 | 6.1 | 0.01 | Jun 22, 2022 | In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page. | ||
| CVE-2026-54461 | Med | 0.35 | 6.5 | 0.00 | Sep 24, 2026 | Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can… | ||
| CVE-2024-53274 | Med | 0.00 | 6.1 | 0.00 | Dec 12, 2024 | Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a… | ||
| CVE-2024-53273 | Med | 0.00 | 6.1 | 0.00 | Dec 12, 2024 | Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `RegisterLoginReset.vue` contains a reflected XSS vulnerability due to an incorrect sanitization function. An attacker can… | ||
| CVE-2024-53272 | Med | 0.00 | 6.1 | 0.00 | Dec 12, 2024 | Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sanitization function.… | ||
| CVE-2022-23078 | 0.00 | — | 0.01 | Jun 22, 2022 | In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page. |
- risk 0.40cvss 6.1epss 0.01
In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.
- risk 0.35cvss 6.5epss 0.00
Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can…
- risk 0.00cvss 6.1epss 0.00
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a…
- risk 0.00cvss 6.1epss 0.00
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `RegisterLoginReset.vue` contains a reflected XSS vulnerability due to an incorrect sanitization function. An attacker can…
- risk 0.00cvss 6.1epss 0.00
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sanitization function.…
- CVE-2022-23078Jun 22, 2022risk 0.00cvss —epss 0.01
In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.