28 matches found
EUVD-2026-107862
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2...
CVE-2026-87939
The Drupal Feed Block module contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The module fails to sufficiently validate or sanitize the RSS/Atom feed it generates, which displays items pulled from remote sources. This i...
DRUPAL-CONTRIB-2026-137
The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting XSS vulnerability...
PT-2026-89239
The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting XSS vulnerability...
Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137
The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting XSS vulnerability...
CVE-2025-32393
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.32, there is a DoS vulnerability in ReadRSSFeedBlock. In RSSBlock, feedparser.parser is called to obtain the XML fil...
CVE-2025-62615
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.34, in RSSFeedBlock, the third-party library urllib.request.urlopen is used directly to access the URL, but the inpu...
CVE-2025-62615
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.34, in RSSFeedBlock, the third-party library urllib.request.urlopen is used directly to access the URL, but the inpu...
CVE-2025-62615 AutoGPT has SSRF vulnerability in ReadRSSFeedBlock
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.34, in RSSFeedBlock, the third-party library urllib.request.urlopen is used directly to access the URL, but the inpu...
CVE-2025-62615 AutoGPT has SSRF vulnerability in ReadRSSFeedBlock
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.34, in RSSFeedBlock, the third-party library urllib.request.urlopen is used directly to access the URL, but the inpu...
CVE-2025-62615
AutoGPT's ReadRSSFeedBlock contained an SSRF flaw due to unfiltered URLs used with urllib.request.urlopen, affecting platforms prior to autogpt-platform-beta-v0.6.34. The issue, rated CVSS v4.0 base 9.3 (CRITICAL; NETWORK vector, no user interaction), is patched in v0.6.34. Connected sources (Red...
BIT-MOODLE-2025-3636 Moodle: idor in moodle rss block allows unauthorized access to rss feeds
A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks...
EUVD-2009-1733
Malware in sbrugna...
EUVD-2024-54913
Malicious code in bioql PyPI...
CVE-2024-45753
In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute...
CVE-2024-45753
In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute...
CVE-2024-45753
In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute...
CVE-2024-45753
The ePortfolio management system Mahara versions 23.04.8 and 24.04.4 is vulnerable to Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input within the external RSS feed block , where a malicious value provided in the link attribute of an external feed XML can trigger...