BadgeOS

BadgeOS has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2023; 2 are fixed and 6 remain unpatched as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2023 was the busiest year with 6 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 2 of the records (25%). Other recurring categories include Missing Authorization, SQL Injection.

2 of the records (25%) have a vendor fix, while 6 remain unpatched. The oldest unresolved one dates back to 2023.

4 independent researchers contributed these findings, most of them (4) reported by Alex Thomas.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage25%

Open

Fixed

Get automatic notifications for all BadgeOS vulnerabilities before they are exploited.

Most severe open issueCVSS 6.5CVE-2023-2173

BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion

Read the full analysis

Vulnerability Records

8 records


2023-11-07 00:00	BadgeOS <= 3.7.1.6 - Missing Authorization BadgeOS <= 3.7.1.6	`CVE-2023-47647`	4.3 Medium	Elliot	No
2023-07-05 00:00	BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite BadgeOS <= 3.7.1.6	`CVE-2023-2172`	4.3 Medium	Alex Thomas	No
2023-07-05 00:00	BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries BadgeOS <= 3.7.1.6	`CVE-2023-2174`	4.3 Medium	Alex Thomas	No
2023-07-05 00:00	BadgeOS <= 3.7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode BadgeOS <= 3.7.1.6	`CVE-2023-2171`	5.4 Medium	Alex Thomas	No
2023-07-05 00:00	BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion BadgeOS <= 3.7.1.6	`CVE-2023-2173`	6.5 Medium	Alex Thomas	No
2023-04-18 00:00	BadgeOS <= 3.7.1.6 - Cross-Site Request Forgery BadgeOS <= 3.7.1.6	`CVE-2022-41987`	4.3 Medium	István Márton	No
2022-08-23 00:00	BadgeOS <= 3.7.1.2 - Authenticated (Subscriber+) SQL Injection BadgeOS <= 3.7.1.2	`CVE-2022-2958`	8.8 High	cydave	Yes
2022-04-13 00:00	BadgeOS <= 3.7.0 - Unauthenticated SQL Injection BadgeOS <= 3.7.0	`CVE-2022-0817`	9.8 Critical	cydave	Yes

Showing 1–8 of 8 reports