CVE-2025-50578

Heimdall 2.6.3-ls307 (LinuxServer.io) contains a vulnerability in handling user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirects, enabling loading of external resou...

CVE-2025-54597

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter...

CVE-2025-54597

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter...

Heimdall 跨站脚本漏洞

Heimdall is an open source application panel and launcher for LinuxServer.io. A cross-site scripting vulnerability exists in Heimdall versions prior to 2.7.3, which stems from an uncleared q parameter that could lead to a cross-site scripting attack...

PT-2025-30990

Name of the Vulnerable Software and Affected Versions Heimdall versions prior to 2.7.3 Description Heimdall is susceptible to a cross-site scripting XSS issue via the q parameter. Recommendations Update Heimdall to version 2.7.3 or later...

CVE-2025-54597

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter...

CVE-2025-54597

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter...

CVE-2025-54597

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter...

CVE-2025-54597

CVE-2025-54597 affects LinuxServer.io Heimdall prior to 2.7.3. A cross-site scripting (XSS) vulnerability is triggered via the query parameter q in the web UI, due to an uncleared input. Impact is described as XSS with potential user impact on affected deployments; exploitation details are not pr...

CVE-2025-54597

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter...

CVE-2024-51358

An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application...

CVE-2023-51803

LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "" substring...

CVE-2022-47968

Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page...

CVE-2024-51358

An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application...

CVE-2024-51358

CVE-2024-51358 affects Linux Server Heimdall v2.6.1. A remote attacker can execute arbitrary code by sending a crafted script to the Add new application endpoint. Impact per CVSS: HIGH confidentiality, integrity, and availability; base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Multiple sou...

CVE-2024-51358

An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application...

CVE-2024-51358

An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application...

Heimdall 安全漏洞

Heimdall is an open source application panel and launcher for LinuxServer.io. A security vulnerability exists in Heimdall version v.2.6.1, which originates from a remote attacker who can execute arbitrary code via a specially crafted script that adds a new application...

PT-2024-34604 · Unknown · Linux Server Heimdall

Name of the Vulnerable Software and Affected Versions: Linux Server Heimdall version 2.6.1 Description: An issue in Linux Server Heimdall allows a remote attacker to execute arbitrary code via a crafted script to the "Add new application" endpoint. Recommendations: For Linux Server Heimdall versi...

CVE-2023-51803

LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "" substring...