dcat-admin vulnerabilities

4 known CVE vulnerabilities in dcat-admin, translated and rated.

CVE-2025-65656Critical
dcat-admin v2.2.3-beta and earlier is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.
CVE-2026-11621Medium
Dcat-Admin up to version 2.2.3-beta has a vulnerability in the editorMDUpload function on the user settings page. Manipulation of the editormd-image-file argument leads to unrestricted file upload. The attack can be remote.
CVE-2024-29644Medium
A Cross-Site Scripting (XSS) vulnerability exists in dcat-admin version 2.1.3 and earlier. A remote attacker can inject a malicious script via the user login box to execute arbitrary code.
CVE-2023-33736Medium
Dcat-Admin v2.1.3-beta has a stored cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS