ViewVC is a web-based source code repository browsing tool with a narrow product scope that is employed in software development environments to provide browsable access to version control systems. The vulnerability footprint is concentrated in a single product and recurs through application-layer input-handling weaknesses, particularly cross-site scripting, sensitive information exposure, and authentication flaws that are characteristic of web interfaces exposed to development teams and potentially broader audiences. These weakness classes reflect the product's role as a web-facing viewer of repository metadata and source code, where improper sanitization and access control have been recurring concerns. Defenders should treat ViewVC instances as internal-facing infrastructure with access restrictions and keep the product updated; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Viewvc over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-5743HIGH viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option. | Nov 7, 2019 | 7.5 | 25 | NO | NO |
CVE-2010-0005HIGH query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remote attackers to bypas | Jan 29, 2010 | 7.5 | 23 | NO | NO |
CVE-2025-54141HIGH ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in th | Jul 22, 2025 | 7.5 | 22 | NO | NO |
CVE-2023-22456MEDIUM ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29. The impact | Jan 3, 2023 | 6.1 | 21 | NO | NO |
CVE-2017-5938MEDIUM Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web s | Mar 15, 2017 | 6.1 | 21 | NO | NO |
CVE-2023-22464MEDIUM ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. The impact of this vul | Jan 4, 2023 | 5.4 | 20 | NO | NO |
CVE-2012-4533MEDIUM Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows re | Nov 19, 2012 | 4.3 | 19 | NO | NO |
CVE-2009-5024MEDIUM ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb row_limit configuration setting, and consequently conduct resource-consumption attacks, via the limit parameter, as | May 23, 2011 | 5.0 | 19 | NO | NO |
CVE-2012-3357MEDIUM The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allow | Jul 22, 2012 | 5.0 | 18 | NO | NO |
CVE-2012-3356MEDIUM The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended acces | Jul 22, 2012 | 5.0 | 18 | NO | NO |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Viewvc.
Media articles that mention a CVE ID that affects a product developed by Viewvc — matched by CVE ID, not by vendor name.