Aggregates CVE and security vulnerability intelligence across all phoenixframework-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Common weakness patterns include vendor risk cross-site scripting and vendor risk open redirect, with potential vendor impact session compromise across vendor surface software deployment use cases.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2021-46871 | tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes. | [email protected] | 6.1 | 0.23% | 2023-01-10 | 2025-04-09 |
| CVE-2022-42975 | socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token. | [email protected] | 7.5 | 0.19% | 2022-10-17 | 2025-05-10 |
| CVE-2017-1000163 | The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks. | [email protected] | 6.1 | 1.80% | 2017-11-17 | 2026-05-13 |