GHSA-jxc4-54g3-j7vp
Medium · 5.4CVSS
5.4
EPSS
—
Published
Feb 17, 2026
CISA due date
—
The record
Indico Affected by Cross-Site-Scripting via material uploads
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | indico | 0 | 3.3.10 |
Related vulnerabilities
- CVE-2026-25739 Indico is an event management system that uses Flask-Multipass, a multi-backend… Same vulnerability
- GHSA-rfpp-2hgm-gp5v Indico has a missing access check in the event series management API Also affects indico
- CVE-2026-28352 Indico is an event management system that uses Flask-Multipass, a multi-backend… Also affects indico
- CVE-2026-25738 Indico is an event management system that uses Flask-Multipass, a multi-backend… Also affects indico
- GHSA-f47c-3c5w-v7p4 Indico has Server-Side Request Forgery (SSRF) in multiple places Also affects indico
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79