Usememos vulnerabilities
77 vulnerabilities
Known vulnerabilities in Usememos products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Memos77 vulnerabilities
- Usememos/Memos58 vulnerabilities
CVE-2025-65798github.com/usememosmemos+1
EPSS score0.18%
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.CVE-2025-65799github.com/usememosmemos+1EPSS score0.21%
A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.CVE-2025-65796github.com/usememosmemos+1EPSS score0.20%
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.CVE-2025-65795github.com/usememosmemos+1EPSS score0.26%
Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.CVE-2025-65797github.com/usememosmemos+1EPSS score0.28%
Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).CVE-2025-56760github.com/usememosmemos+1EPSS score0.35%
When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in the name, allowing arbitrary file write on the server.CVE-2025-56761github.com/usememosmemos+1EPSS score0.26%
Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.CVE-2025-22952github.com/usememosmemos+1EPSS score2.93%
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.CVE-2025-50738github.com/usememosmemos+1EPSS score2.38%
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be exploited by an attacker to disclose the viewing user's IP address, browser User-Agent string, and potentially other request-specific information to the attacker-controlled server, leading to information disclosure and user tracking.CVE-2022-4845github.com/usememosmemos+2EPSS score0.27%
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4734github.com/usememosmemos+2EPSS score0.80%
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4802github.com/usememosmemos+2EPSS score0.58%
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4865github.com/usememosmemos+2EPSS score1.02%
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4684github.com/usememosmemos+2EPSS score0.63%
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-4840github.com/usememosmemos+2EPSS score0.67%
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4809github.com/usememosmemos+2EPSS score0.94%
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4695github.com/usememosmemos+2EPSS score0.67%
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-4688github.com/usememosmemos+2EPSS score0.76%
Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-4813github.com/usememosmemos+2EPSS score0.55%
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4808github.com/usememosmemos+2EPSS score0.43%
Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.