Exploit for Unrestricted Upload of File with Dangerous Type in Stefanprodan Podinfo

CVE-2025-70849: Stored XSS in Podinfo Summary A security v...

CVE-2025-70849

creationtimestamp| type| source ---|---|--- 2026-02-15 20:28:15+00:00| published-proof-of-concept| https://t.me/realcodeb0ss/325 2026-05-17 02:07:47+00:00| published-proof-of-concept| Telegram/qFnncewXFdOxDivGoEqJX19AvA6N2dSwzORt9UZIQWFUQU 2026-06-02 09:00:04+00:00| seen|...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...