Search for packages
| purl | pkg:npm/droppy@3.5.0 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-xr2b-ymsv-sbbq
Aliases: CVE-2020-7757 GHSA-grv5-w5vr-8h98 |
There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-sdtz-wuvr-jfdj | No CSRF Validation Droppy does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others. |
GMS-2016-19
|
| VCID-wp9m-gax9-syck | No CSRF Validation in droppy |
CVE-2016-10529
GHSA-rhvc-x32h-5526 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-12T17:29:23.424057+00:00 | GitLab Importer | Affected by | VCID-xr2b-ymsv-sbbq | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/droppy/CVE-2020-7757.yml | 38.6.0 |
| 2026-06-12T15:41:31.508855+00:00 | GitLab Importer | Fixing | VCID-wp9m-gax9-syck | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/droppy/CVE-2016-10529.yml | 38.6.0 |
| 2026-06-12T15:39:22.542512+00:00 | GitLab Importer | Fixing | VCID-sdtz-wuvr-jfdj | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/droppy/GMS-2016-19.yml | 38.6.0 |
| 2026-06-12T08:11:15.115126+00:00 | GithubOSV Importer | Fixing | VCID-wp9m-gax9-syck | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-rhvc-x32h-5526/GHSA-rhvc-x32h-5526.json | 38.6.0 |
| 2026-06-11T20:25:01.996542+00:00 | GHSA Importer | Fixing | VCID-wp9m-gax9-syck | https://github.com/advisories/GHSA-rhvc-x32h-5526 | 38.6.0 |