CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

CVE-2025-70849: Improper Neutralization of Input During Web Page Generation

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

📄 Podinfo 6.10.0 Cross Site Scripting

Podinfo versions 6.10.0 and below suffer from a cross site scripting vulnerability. CVE-2025-70849: Stored XSS in Podinfo Summary A security vulnerability CWE-79 was identified in Podinfo, a web application for demonstrating Kubernetes microservices. The /store feature allows unauthenticated user...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: sbomqs, extism, crossplane-provider-aws-sns, clickhouse-operator, nri-haproxy, dex, sonobuoy, linkerd2-proxy-init, pguser, aws-signer-notation-plugin, sealed-secrets, langfuse, cargobump, cass-operator, mc, crossplane-provider-aws-cloudwatchlogs, nerdctl,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: minio, crossplane-provider-aws-rds, db-operator, sbomqs, crossplane-provider-aws-s3, extism, crossplane-provider-aws-kinesis, ksops, crossplane-provider-aws-sns, wgcf, aws-flb-cloudwatch, amazon-cloudwatch-agent-operator, clickhouse-operator, dockerize,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: sbomqs, extism, crossplane-provider-aws-sns, clickhouse-operator, nri-haproxy, dex, sonobuoy, linkerd2-proxy-init, pguser, aws-signer-notation-plugin, sealed-secrets, langfuse, cargobump, cass-operator, mc, crossplane-provider-aws-cloudwatchlogs, nerdctl,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: minio, crossplane-provider-aws-rds, db-operator, sbomqs, crossplane-provider-aws-s3, extism, crossplane-provider-aws-kinesis, ksops, crossplane-provider-aws-sns, wgcf, aws-flb-cloudwatch, amazon-cloudwatch-agent-operator, clickhouse-operator, dockerize,...