Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

indico

15 known vulnerabilities (1 high, 12 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
15 · 1 high, 12 medium
Weekly downloads
424
Dependents
32
Registry
PyPI

Advisories 15

  • CVE-2026-107397Medium 4.4

    Indico: Cross-Site-Scripting in minutes editor

    Affected: fixed in 3.3.13.

  • CVE-2026-107396Medium 5.4

    Indico: Cross-Site-Scripting in link fields

    Affected: fixed in 3.3.13.

  • CVE-2026-107395Medium 4.3

    Indico: Missing access check in legacy session export API

    Affected: fixed in 3.3.13.

  • CVE-2026-107394Medium 6.8

    Indico: Incomplete Server-Side Request Forgery (SSRF) check

    Affected: fixed in 3.3.13.

  • Indico discloses local files resulting in Remote Code Execution through LaTeX injection

    Affected: fixed in 3.3.12.

  • CVE-2026-28352Medium 6.5

    Indico missing access check in event series management API

    Affected: fixed in 3.3.11.

  • CVE-2026-25739Medium 5.4

    Indico affected by Cross-Site-Scripting via material uploads

    Affected: fixed in 3.3.10.

  • CVE-2026-25738Medium 6.9

    Indico has Server-Side Request Forgery (SSRF) in multiple places

    Affected: fixed in 3.3.10.

  • CVE-2025-59035Medium 4.6

    Indico vulnerable to Cross-Site Scripting via LaTeX math code

    Affected: fixed in 3.3.8.

  • CVE-2025-59034Medium 4.3

    Indico may disclose unauthorized user details access via legacy API

    Affected: fixed in 3.3.8.

  • CVE-2025-53640Medium 5.3

    Indico vulnerable to user enumeration via API endpoint

    Affected: from 2.2, fixed in 3.3.7.

  • A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted…

    Affected: from 3.2.9, fixed in 3.3.3.

  • CVE-2024-45399Medium 4.3

    Indico has a Cross-Site-Scripting during account creation

    Affected: fixed in 3.3.4.

  • CVE-2023-37901Medium 5.4

    Cross-Site-Scripting via confirmation prompts

    Affected: fixed in 3.2.6.

  • CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.

    Affected: fixed in 2.3.4; fixed in 2.3.4.