Search criteria ⓘ Use full-text search for keyword queries.
Combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by dates instead of relevance.

2 vulnerabilities by openreplay

CVE-2026-28443 (GCVE-0-2026-28443)

Vulnerability from cvelistv5 – Published: 2026-03-05 20:53 – Updated: 2026-03-06 16:08
VLAI?
Title
OpenReplay: SQL injection in cards/search via unvalidated sort field parameter
Summary
OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0.
Severity ?
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
Vendor Product Version
openreplay openreplay Affected: < 1.20.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28443",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-06T16:08:03.455688Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T16:08:11.944Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openreplay",
          "vendor": "openreplay",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.20.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-05T20:53:17.967Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-q6gf-3qg3-pww5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-q6gf-3qg3-pww5"
        }
      ],
      "source": {
        "advisory": "GHSA-q6gf-3qg3-pww5",
        "discovery": "UNKNOWN"
      },
      "title": "OpenReplay: SQL injection in cards/search via unvalidated sort field parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28443",
    "datePublished": "2026-03-05T20:53:17.967Z",
    "dateReserved": "2026-02-27T15:54:05.140Z",
    "dateUpdated": "2026-03-06T16:08:11.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-48226 (GCVE-0-2023-48226)

Vulnerability from cvelistv5 – Published: 2023-11-21 19:37 – Updated: 2024-08-02 21:23
VLAI?
Title
OpenReplay HTML Injection vulnerability
Summary
OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-20 - Improper Input Validation
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
Vendor Product Version
openreplay openreplay Affected: = 1.14.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:23:39.200Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4"
          },
          {
            "name": "https://bugcrowd.com/vulnerability-rating-taxonomy",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugcrowd.com/vulnerability-rating-taxonomy"
          },
          {
            "name": "https://capec.mitre.org/data/definitions/242.html",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://capec.mitre.org/data/definitions/242.html"
          },
          {
            "name": "https://cwe.mitre.org/data/definitions/20.html",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cwe.mitre.org/data/definitions/20.html"
          },
          {
            "name": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openreplay",
          "vendor": "openreplay",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-21T19:37:57.103Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4"
        },
        {
          "name": "https://bugcrowd.com/vulnerability-rating-taxonomy",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugcrowd.com/vulnerability-rating-taxonomy"
        },
        {
          "name": "https://capec.mitre.org/data/definitions/242.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://capec.mitre.org/data/definitions/242.html"
        },
        {
          "name": "https://cwe.mitre.org/data/definitions/20.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "name": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421"
        }
      ],
      "source": {
        "advisory": "GHSA-xpfv-454c-3fj4",
        "discovery": "UNKNOWN"
      },
      "title": "OpenReplay HTML Injection vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-48226",
    "datePublished": "2023-11-21T19:37:57.103Z",
    "dateReserved": "2023-11-13T13:25:18.480Z",
    "dateUpdated": "2024-08-02T21:23:39.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}