Search for packages
| purl | pkg:npm/%40sync-in/server@1.9.3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-x68j-5gck-1uge
Aliases: CVE-2026-41161 GHSA-43fj-qp3h-hrh5 |
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. This issue has been patched in version 2.2.0. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-p5m9-fn52-b7a3 | A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information, including the user's session cookies. |
CVE-2025-67438
GHSA-9jmq-xgjm-p8c2 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-12T22:05:24.207961+00:00 | GitLab Importer | Affected by | VCID-x68j-5gck-1uge | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@sync-in/server/CVE-2026-41161.yml | 38.6.0 |
| 2026-06-12T15:50:31.737312+00:00 | GitLab Importer | Fixing | VCID-p5m9-fn52-b7a3 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@sync-in/server/CVE-2025-67438.yml | 38.6.0 |
| 2026-06-12T07:47:32.259202+00:00 | GithubOSV Importer | Fixing | VCID-p5m9-fn52-b7a3 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-9jmq-xgjm-p8c2/GHSA-9jmq-xgjm-p8c2.json | 38.6.0 |
| 2026-06-11T20:38:04.866053+00:00 | GHSA Importer | Fixing | VCID-p5m9-fn52-b7a3 | https://github.com/advisories/GHSA-9jmq-xgjm-p8c2 | 38.6.0 |