erudika vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20241
3. 20252
4. 20268

Newest CVEs

• CVE-2026-57183

  Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and Logs

  Erudika · scoold

  Medium6.1
• CVE-2026-55840

  Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass

  Erudika · scoold

  Medium5.4
• CVE-2026-55842

  Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain

  Erudika · scoold

  Medium5.4
• CVE-2026-54676

  Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled

  Erudika · scoold

  Medium6.5
• CVE-2026-54677

  Scoold: Authenticated user can post replies and comments to private-space questions without space membership

  Erudika · scoold

  Medium6.5
• CVE-2026-42176

  Scoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation)

  Erudika · scoold

  Medium6.7
• CVE-2026-39354

  Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask

  Erudika · scoold

  Medium6.5
• CVE-2026-34832

  Scoold: Cross-Account Feedback Deletion (IDOR)

  Erudika · scoold

  Medium6.5
• CVE-2025-49009

  Para Inserts Sensitive Information into Log File for Facebook authentication

  Erudika · para

  Medium6.2
• CVE-2025-48955

  Para Server Logs Sensitive Information

  Erudika · para

  Medium6.2