VulnerableCode Package Details - pkg:composer/appwrite/server-ce@0.1.15

Search for packages

Vulnerability	Summary	Fixed by
VCID-4ptx-3zht-g7b8 Aliases: CVE-2022-2925 GHSA-5ffj-mph5-c5hv	Appwrite Vulnerable to Cross-site Scripting Appwrite is vulnerable to stored cross-site scripting in usernames, function names, storage bucket names, and database collection names.	1.0.0-RC1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1.0.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-dtju-jew3-3qgz Aliases: CVE-2023-27159 GHSA-hxgx-584x-vwm8	Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.	There are no reported fixed by versions.
VCID-x7wu-vcge-33g6 Aliases: CVE-2021-23682 GHSA-v9p9-535w-4285	Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.	0.11.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 0.12.2 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-4ptx-3zht-g7b8
Aliases:
CVE-2022-2925
GHSA-5ffj-mph5-c5hv

Appwrite Vulnerable to Cross-site Scripting Appwrite is vulnerable to stored cross-site scripting in usernames, function names, storage bucket names, and database collection names.

1.0.0-RC1
Affected by 1 other vulnerability.

1.0.0
Affected by 1 other vulnerability.

VCID-dtju-jew3-3qgz
Aliases:
CVE-2023-27159
GHSA-hxgx-584x-vwm8

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

There are no reported fixed by versions.

VCID-x7wu-vcge-33g6
Aliases:
CVE-2021-23682
GHSA-v9p9-535w-4285

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.

0.11.1
Affected by 3 other vulnerabilities.

0.12.2
Affected by 2 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T03:38:07.907381+00:00	GitLab Importer	Affected by	VCID-dtju-jew3-3qgz	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/appwrite/server-ce/CVE-2023-27159.yml	38.6.0
2026-06-06T02:49:21.190305+00:00	GitLab Importer	Affected by	VCID-4ptx-3zht-g7b8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/appwrite/server-ce/CVE-2022-2925.yml	38.6.0
2026-06-06T01:30:20.290134+00:00	GitLab Importer	Affected by	VCID-x7wu-vcge-33g6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/appwrite/server-ce/CVE-2021-23682.yml	38.6.0