podinfo 跨站脚本漏洞

Podinfo is a Kubernetes microservice template developed by Stefan Prodan. Versions of Podinfo 6.11.2 and earlier contained a cross-site scripting vulnerability. This vulnerability stemmed from the fact that the echoHandler did not set a clear Content-Type or X-Content-Type-Options header on the...

Security-Advisories

Security Advisories Public security advisories and proof-of-c...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, kubernetes-dashboard-metrics-scraper-fips, dbmate, listmonk, dataplaneapi, aws-load-balancer-controller, k8s-metacollector, flux-source-controller-fips, grafana-operator-fips, github-mcp-server, mariadb-operator, victoriametrics-cluster-fips,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, kubernetes-dashboard-metrics-scraper-fips, dbmate, listmonk, dataplaneapi, aws-load-balancer-controller, k8s-metacollector, flux-source-controller-fips, grafana-operator-fips, github-mcp-server, mariadb-operator, victoriametrics-cluster-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: prometheus-operator-fips, tigera-operator, backup-restore-operator-fips, crossplane-provider-aws-rds-fips, crane-fips, listmonk, dbmate, jfrog-cli, newrelic-fluent-bit-output-fips, percona-server-mongodb-operator, cert-manager-google-cas-issuer-fips, aactl,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: crane-fips, prometheus-pgbouncer-exporter, aactl, kubernetes-csi-external-attacher, juicefs-csi-driver, percona-xtradb-cluster-operator-fips, victorialogs, licenseclassifier, lvm-driver, crossplane-provider-aws-ssm, metrics-agent-fips, cri-tools,...

SUSE CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

GO-2026-4404 Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS) in github.com/stefanprodan/podinfo

Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting XSS in github.com/stefanprodan/podinfo...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

GHSA-MW8W-Q3F7-2V85 Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

Exploit for CVE-2025-70849

CVE-2025-70849-Podinf...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

PT-2026-5988

Name of the Vulnerable Software and Affected Versions podinfo versions through 6.9.0 Description An arbitrary file upload issue exists in podinfo through version 6.9.0. Unauthenticated attackers can upload arbitrary files by sending a crafted POST request to the /store endpoint. The application...

podinfo 安全漏洞

Podinfo is a Kubernetes microservice template developed by Stefan Prodan. Versions of Podinfo 6.9.0 and earlier contain security vulnerabilities. These vulnerabilities stem from unvalidated attackers being able to upload arbitrary files through specially crafted POST requests. Additionally, the...

PT-2026-6454

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

EUVD-2025-206697

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

📄 Podinfo 6.10.0 Cross Site Scripting

Podinfo versions 6.10.0 and below suffer from a cross site scripting vulnerability. CVE-2025-70849: Stored XSS in Podinfo Summary A security vulnerability CWE-79 was identified in Podinfo, a web application for demonstrating Kubernetes microservices. The /store feature allows unauthenticated user...