Known vulnerabilities in SimpleSAMLphp

Software: SimpleSAMLphp
Software CPE: cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:*
Total vulnerabilities: 15
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting SimpleSAMLphp SimpleSAMLphp is affected by 15 known vulnerabilities: 3 high, 5 medium, 7 low Critical High Medium Low

Vulnerabilities (15)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU133100 - Insufficient Verification of Data Authenticity
CVE-2026-49284
CWE-345 Low
No
No
2.4.6, 2.5.1 31.05.2026 SB2026053110
#VU101091 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-52596
CWE-611 High
No
No
2.0.15, 2.1.7, 2.2.4, 2.3.4 02.12.2024 SB2024120232
SB2024120354
#VU30303 - Exposure of sensitive information to an unauthorized actor
CVE-2020-5301
CWE-200 Low
No
No
1.18.6 21.04.2020 SB2020042134
#VU24804 - Improper Output Neutralization for Logs
CVE-2020-5225
CWE-117 Medium
No
No
1.18.4 31.01.2020 SB2020013117
#VU24803 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-5226
CWE-79 Low
No
No
1.18.4 31.01.2020 SB2020013117
#VU23463 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
1.17.8 09.12.2019 SB2019120908
#VU22596 - Reachable Assertion
CVE-2019-3465
CWE-617 Medium
No
No
1.17.7 07.11.2019 SB2019110713
SB2019110714
SB2019123106
and 15 more
#VU31345 - Improper Verification of Cryptographic Signature
CVE-2018-7711
CWE-347 High
No
No
1.15.4 05.03.2018 SB2018030513
#VU31347 - Improper Verification of Cryptographic Signature
CVE-2018-7644
CWE-347 Medium
No
No
1.15.3 05.03.2018 SB2018030515
#VU31356 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2018-6520
CWE-601 Low
No
No
1.15.1 02.02.2018 SB2018020210
#VU37570 - Improper input validation
CVE-2018-6521
CWE-20 High
No
No
1.15.2 02.02.2018 SB2018020211
#VU38369 - Inadequate Encryption Strength
CVE-2017-12871
CWE-326 Medium
No
No
- 01.09.2017 SB2017090112
#VU31447 - Improper input validation
CVE-2016-9955
CWE-20 Low
No
No
1.14.11 17.02.2017 SB2017021711
#VU44365 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-0040
CWE-79 Low
No
No
- 24.01.2012 SB2012012404
#VU44367 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-0908
CWE-79 Low
No
No
- 24.01.2012 SB2012012404