31 matches found
CVE-2023-45966
CVE-2023-45966 Слепой SSRF в umputun/remark42 приводит к Blind SSRF из-за отсутствия поля title и недостаточной фильтрации поля url при создании комментария. Дополнительная информация Исправлено в коммите: efceed6 Тип уязвимости Другое CWE-918: Подделка запросов на стороне сервера SSRF Вендор...
SUSE CVE-2026-48788
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting XSS vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and...
GO-2026-5804 Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing in github.com/umputun/remark42
Remark42: Cross-Site Scripting XSS on /api/v1/img via content-type spoofing in github.com/umputun/remark42...
GHSA-4C8J-MGM4-QQVP Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Summary The remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42's own origin. The download path decides whether the fetched resource is an image by looking only at the Content-Type header the remote server claims — it never inspects the actual bytes. The...
EUVD-2026-37511
Remark42: Cross-Site Scripting XSS on /api/v1/img via content-type spoofing...
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Summary The remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42's own origin. The download path decides whether the fetched resource is an image by looking only at the Content-Type header the remote server claims — it never inspects the actual bytes. The...
CVE-2026-48788
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting XSS vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and...
CVE-2026-48788: Improper Neutralization of Input During Web Page Generation
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting XSS vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and...
CVE-2026-48788 Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting XSS vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and...
CVE-2026-48788
CVE-2026-48788 affects Remark42 (versions 1.6.0–1.15.0). The known issue is a content-type spoofing-based XSS in the image proxy: during download the proxy checks Content-Type headers to decide if a resource is an image, but the serving phase sniffing can differ, leading to a mismatch that lets H...
CVE-2026-48788 Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting XSS vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and...
CVE-2026-48788 Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting XSS vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and...
PT-2026-50130
Name of the Vulnerable Software and Affected Versions Remark42 versions 1.6.0 through 1.15.0 Description Remark42 contains a Cross-Site Scripting XSS issue exploitable through content-type spoofing via the image proxy. The proxy fetches a remote URL and re-serves the response from its own origin....
CVE-2023-45966
umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery SSRF vulnerability...
EUVD-2021-15909
Malware in sbrugna...
EUVD-2023-50228
Malicious code in bioql PyPI...
CVE-2021-29271
remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: LocatorURL:" followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go...
CVE-2023-45966
umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery SSRF vulnerability...
