Hallowelt maintains a modest but prominent vulnerability footprint centered on BlueSpice and its Common User Interface product, both of which are deployed across collaborative and knowledge-management environments. The vendor's disclosures cluster around web-application input-handling weaknesses, principally cross-site scripting, output-encoding defects, and improper input validation, reflecting the challenges of securing user-facing form processing and content rendering in wiki and collaboration platforms. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Hallowelt over time
Signals from CVEs in this vendor scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-48007MEDIUM Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS).
This issue affects BlueSpice: fr | Sep 19, 2025 | 6.4 | 22 | NO | NO |
CVE-2025-46703MEDIUM Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS).
This issue affects BlueSpice: from 5 t | Sep 19, 2025 | 6.4 | 22 | NO | NO |
CVE-2022-3895MEDIUM Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS). | Nov 15, 2022 | 6.1 | 22 | NO | NO |
CVE-2022-2511MEDIUM Cross-site Scripting (XSS) vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of th | Jul 22, 2022 | 6.1 | 22 | NO | NO |
CVE-2022-2510MEDIUM Cross-site Scripting (XSS) vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page "Special:SearchCenter", | Jul 22, 2022 | 6.1 | 22 | NO | NO |
CVE-2022-41814MEDIUM Cross-site Scripting (XSS) vulnerability in BlueSpiceFoundation extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the histo | Nov 15, 2022 | 5.4 | 21 | NO | NO |
CVE-2025-57880MEDIUM Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS).
This issue affects BlueSpice | Sep 19, 2025 | 5.4 | 20 | NO | NO |
CVE-2022-42001MEDIUM Cross-site Scripting (XSS) vulnerability in BlueSpiceBookshelf extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the book n | Nov 15, 2022 | 5.4 | 20 | NO | NO |
CVE-2022-42000MEDIUM Cross-site Scripting (XSS) vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into the comment section of | Nov 15, 2022 | 5.4 | 20 | NO | NO |
CVE-2022-41789MEDIUM Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the default page header o | Nov 15, 2022 | 5.4 | 20 | NO | NO |
Signals from CVEs in this vendor scope (15 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Hallowelt.
Media articles that mention a CVE ID that affects a product developed by Hallowelt — matched by CVE ID, not by vendor name.