Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Summary During an SSG build, page definitions returned by getSsgPages can provide custom dir and filename values. The builder joined those values to build.distDir and wrote the generated page without verifying that the final destination remained inside the distribution directory. Details A page...

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...

EUVD-2026-93573

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories...

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...

EUVD-2026-93569

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server...

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server vulnerability discovered by ? in WordPress Npm quasar versions = 2.23.2...

GHSA-68JQ-FHCH-4XQ4 Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Vulnerability Details File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js lines 149-176: getAttr and getHead Sink: injectServerMeta same file → ctx.headTags += getHeaddata, interpolated verbatim into the raw HTTP response by the production SSR template...

EUVD-2026-93517

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead...

NPM: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

NPM: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead vulnerability discovered by ? in WordPress Npm quasar versions 2.22.0...

GHSA-PQ96-JPMF-W254 Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Vulnerability Details File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js lines 149-176: getAttr and getHead Sink: injectServerMeta same file → ctx.headTags += getHeaddata, interpolated verbatim into the raw HTTP response by the production SSR template...

Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Vulnerability Details File: icongenie/lib/utils/get-assets-files.js line 35, absoluteName: joinappDir, asset.folder, asset.name Validation gap: icongenie/lib/utils/validate-profile-object.js assetsSchema — folder/name only checked with Joi.string.required.min1, no restriction on .. sequences or...

EUVD-2026-93568

Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile...

GHSA-WMPW-J6QV-MW88 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Vulnerability Details File: icongenie/lib/utils/get-assets-files.js line 35, absoluteName: joinappDir, asset.folder, asset.name Validation gap: icongenie/lib/utils/validate-profile-object.js assetsSchema — folder/name only checked with Joi.string.required.min1, no restriction on .. sequences or...

CVE-2020-5421

Riproduzione della vulnerabilità di sicurezza di Spring CVE-2020-5421 Panoramica della vulnerabilità CVE-2020-5421 può aggirare la protezione contro gli attacchi RFD tramite il parametro di percorso jsessionid. La protezione precedente contro RFD è stata aggiunta per far fronte a CVE-2015-5211...

CVE-2022-22965

spring4shell ⭐ una implementación python de CVE-2022-22965 que proporciona un prompt al usuario al estilo de una sesión SSH. El script está diseñado para ser fácil de entender y ejecutar, con legibilidad y accesibilidad, según la elección del usuario. Diseñado para explotar la vulnerabilidad en...

CVE-2018-15133-laravel-framework

CVE-2018-15133 - Laboratorio Vulnerable de Laravel Framework 5.6.x Este repositorio proporciona un laboratorio Docker reproducible para CVE-2018-15133 RCE por deserialización de token en Laravel Framework cuando se conoce APPKEY. La aplicación está fijada a una versión vulnerable de Laravel 5.6.x...

Important: Red Hat Security Advisory: Release of components for Service Telemetry Framework 1.5.7

Release of components for the Service Telemetry Framework Service Telemetry Framework STF provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat...

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 with Metasploit-Framework The CVE-2019-0708 vulnerability exploits a flaw in user authentication, allowing bypass of authentication without any interaction. It directly connects via the RDP protocol to send malicious code and execute commands on the server. If exploite...

CVE-2023-22515

CVE-2023-22515: Informe de análisis de vulnerabilidad de escalada de privilegios en Confluence Data Center & Server 1. Resumen Overview CVE-2023-22515 es una vulnerabilidad crítica de Control de Acceso Roto Broken Access Control encontrada en los productos Atlassian Confluence Data Center y...