CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

CVE-2025-70849

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

CVE-2025-70849: Improper Neutralization of Input During Web Page Generation

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...

📄 Podinfo 6.10.0 Cross Site Scripting

Podinfo versions 6.10.0 and below suffer from a cross site scripting vulnerability. CVE-2025-70849: Stored XSS in Podinfo Summary A security vulnerability CWE-79 was identified in Podinfo, a web application for demonstrating Kubernetes microservices. The /store feature allows unauthenticated user...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: dbmate, percona-server-mongodb-operator, aactl, kubernetes-csi-external-attacher, cosign, kapp, hivemind, rancher-system-upgrade-controller, licenseclassifier, lvm-driver, container-object-storage-interface, cri-tools, kserve-modelmesh-serving,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: dbmate, percona-server-mongodb-operator, aactl, kubernetes-csi-external-attacher, cosign, kapp, hivemind, rancher-system-upgrade-controller, licenseclassifier, lvm-driver, container-object-storage-interface, cri-tools, kserve-modelmesh-serving,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: hydra, nats-top, local-path-provisioner, rancher-telemetry, litestream, dbmate, percona-server-mongodb-operator, sftpgo-plugin-auth, aactl, descheduler, amazon-cloudwatch-agent-operator, terraform-provider-time, wgcf, chisel, crossplane-provider-sql,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: hydra, nats-top, local-path-provisioner, rancher-telemetry, litestream, dbmate, percona-server-mongodb-operator, sftpgo-plugin-auth, aactl, descheduler, amazon-cloudwatch-agent-operator, terraform-provider-time, wgcf, chisel, crossplane-provider-sql,...