Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails

Summary The Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation introduces a Cross-Site WebSocket Hijacking CSWSH vulnerability. An attacker can host a malicious website that, when visited by a developer running Mailpit locally,...

CVE-2023-29505

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking...

EUVD-2020-17787

Malware in sbrugna...

EUVD-2021-24319

Malware in sbrugna...

EUVD-2019-7960

Malware in sbrugna...

EUVD-2021-1233

Malware in sbrugna...

EUVD-2024-54549

Malicious code in bioql PyPI...

EUVD-2024-0618

Malicious code in bioql PyPI...

EUVD-2025-0225

Malicious code in bioql PyPI...

EUVD-2025-7066

Malicious code in bioql PyPI...

EUVD-2023-34299

Malicious code in bioql PyPI...

EUVD-2023-1957

Malicious code in bioql PyPI...

EUVD-2023-12942

Malicious code in bioql PyPI...

EUVD-2023-33072

Malicious code in bioql PyPI...

EUVD-2025-25135

Malicious code in bioql PyPI...

EUVD-2021-6870

Malicious code in bioql PyPI...

Cross-Site WebSocket Hijacking (CSWSH)

github.com/komari-monitor/komari is vulnerable to Cross-Site WebSocket Hijacking CSWSH. The vulnerability is due to disabled origin checking in the WebSocket upgrader, which allows an attacker to send malicious requests using a victim’s browser cookies and achieve remote code execution...

GO-2025-3874 Komari vulnerable to Cross-site WebSocket Hijacking in github.com/komari-monitor/komari

Komari vulnerable to Cross-site WebSocket Hijacking in github.com/komari-monitor/komari...

GHSA-Q355-H244-969H Komari vulnerable to Cross-site WebSocket Hijacking

Summary WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking CSWSH attacks against authenticated users Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.goL33-L35 Any third party website can send request...

Security Bulletin: IBM Db2 Mirror for i GUI is affected by cross-site WebSocket hijacking and session fixation vulnerabilities [CVE-2025-36116, CVE-2025-36117].

Summary IBM Db2 Mirror for i GUI is affected by cross-site WebSocket hijacking and session fixation vulnerabilities as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerabilities as described in the remediation/fixes section...