BTCPay Server is a self-hosted, open-source cryptocurrency payment processing platform deployed across merchant payment infrastructure and cryptocurrency commerce applications. The vendor's vulnerability exposure centers on its core server product and recurs through web-application weakness classes including cross-site scripting, path traversal, and information disclosure, which reflect the authentication, input handling, and sensitive-data management demands of a payment-processing platform. Defend against this vendor's disclosures by tracking updates to exposed merchant instances and validating access controls around payment configuration; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Btcpayserver over time
Signals from CVEs in this vendor scope (17 CVEs).
17 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-0493HIGH Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
| Jan 26, 2023 | 8.8 | 41 | NO | YES |
CVE-2022-32984HIGH BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML | Jan 31, 2023 | 7.5 | 25 | NO | NO |
CVE-2021-29249HIGH BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability. | Mar 26, 2021 | 7.5 | 24 | NO | NO |
CVE-2021-3646MEDIUM btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Sep 10, 2021 | 6.1 | 22 | NO | NO |
CVE-2021-29246MEDIUM BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin | May 5, 2021 | 6.7 | 22 | NO | NO |
CVE-2021-29251MEDIUM BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies). This affects Docker use cases in which a mail server is conf | Apr 1, 2021 | 6.5 | 22 | NO | NO |
CVE-2023-0748MEDIUM Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6.
| Feb 8, 2023 | 6.1 | 21 | NO | NO |
CVE-2023-1270MEDIUM Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3. | Mar 8, 2023 | 5.4 | 20 | NO | NO |
CVE-2023-1149MEDIUM Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0. | Mar 2, 2023 | 5.4 | 20 | NO | NO |
CVE-2023-0879MEDIUM Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.
| Feb 17, 2023 | 5.4 | 20 | NO | NO |
Signals from CVEs in this vendor scope (17 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Btcpayserver.
Media articles that mention a CVE ID that affects a product developed by Btcpayserver — matched by CVE ID, not by vendor name.