CVE-2025-55817

نوع الثغرة Cross Site Scripting XSS المكون المتأثر تحتوي إعدادات الاتصال لـ Nitro GraphQL من Chillicream على 3 مواقع إدخال مختلفة معرضة لـ Cross Site Scripting XSS. المعلمات المعرضة: SDL Schema Endpoint, Subscription Endpoint, SSE Subscription Endpoint نوع الهجوم عن بُعد تأثير الكشف عن المعلومات...

GHSA-QR3M-XW4C-JQW3 ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents

Impact Hot Chocolate's Utf8GraphQLParser is a recursive descent parser with no recursion depth limit. A crafted GraphQL document with deeply nested selection sets, object values, list values, or list types can trigger a StackOverflowException on payloads as small as 40 KB. Because...

Exploit for CVE-2025-55817

This is a PoC exploit for CVE-2025-55817, a Stored Cross Site Sc...