CVE-2025-70849

CVE-2025-70849: Podinfoにおける格納型XSS 概要 Podinfo （KubernetesマイクロサービスをデモンストレーションするWebアプリケーション）において、セキュリティ脆弱性（CWE-79）が特定されました。/store機能では、認証されていないユーザーが任意のHTML/JSコンテンツをアップロードでき、格納型XSSを引き起こします。 脆弱性詳細 CVE ID: CVE-2025-70849 製品: Podinfo 影響を受けるエンドポイント: /store 脆弱性タイプ: 格納型クロスサイトスクリプティング（XSS） 影響を受けるバージョン:...

CVE-2025-70849-Podinfo

CVE-2025-70849: Podinfoにおける保存型XSS 概要 KubernetesマイクロサービスをデモするWebアプリケーションであるPodinfo において、セキュリティ脆弱性CWE-79が特定されました。/store機能は、認証されていないユーザーが任意のHTML/JSコンテンツをアップロードすることを可能にし、保存型XSSにつながります。 脆弱性の詳細 CVE ID: CVE-2025-70849 製品: Podinfo 影響を受けるエンドポイント: /store 脆弱性の種類: 保存型クロスサイトスクリプティングXSS 影響を受けるバージョン: /store -H...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: stakater-reloader, victoriametrics-cluster, dkron, metacontroller, cert-manager-fips, flux-source-controller, aws-load-balancer-controller-fips, flux-fips, victoriametrics, flux-helm-controller, pgwatch, gotenberg, flux-image-automation-controller, grafana-fips,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, cis-operator, k3s, omnibump, sftpgo-plugin-pubsub, amazon-cloudwatch-agent-operator, aws-node-termination-handler, db-operator, kube-state-metrics, cortex, hcloud, nri-apache, grafana-mimir, kubeflow, containerd, govulncheck,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: git-lfs, k3s, k8sgateway, sftpgo-plugin-pubsub, azure-service-operator, amazon-cloudwatch-agent-operator, timescaledb-parallel-copy, nats-top, db-operator, s5cmd, kubernetes-dashboard-api, cortex, fluxcd-kustomize-mutating-webhook, go-licenses, kubeflow, swagger,...

SUSE CVE-2026-43644

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...

GO-2026-5560 podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo

podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo...

CVE-2026-43644

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...

Exploit for Unrestricted Upload of File with Dangerous Type in Stefanprodan Podinfo

CVE-2025-70849: Stored XSS in Podinfo Summary A security v...

podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...

GHSA-Q23M-VM9R-5745 podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...

CVE-2026-43644

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...

CVE-2026-43644

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...

CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...

EUVD-2026-30275

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...

CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...

CVE-2026-43644

CVE-2026-43644 affects podinfo up to version 6.11.2. The vulnerability is a reflected XSS in the /echo and /api/echo endpoints, caused by the echoHandler writing the request body to the response without setting explicit Content-Type or X-Content-Type-Options headers. Go’s content-type detection m...

CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...

PT-2026-40911

Name of the Vulnerable Software and Affected Versions podinfo versions prior to 6.11.3 Description A reflected cross-site scripting issue exists in the '/echo' and '/api/echo' endpoints. The echoHandler function writes request body content directly to the response without setting explicit...

CVE-2026-43644: Improper Neutralization of Input During Web Page Generation

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...