CVE-2020-27603-bbb-libreoffice-poc

CVE-2020-27603-bbb-libreoffice-poc Proof of Concept of Libreoffice file exfiltration vulnerability in Big Blue Button These ODT files show how to exploit a file exfiltration vulnerability that can happen with server-side Libreoffice rendering, e.g. BigBlueButton. Background:...

Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

¡Bienvenido a React Router! Una plantilla moderna y lista para producción para construir aplicaciones React completas usando React Router. Características 🚀 Renderizado del lado del servidor ⚡️ Reemplazo de Módulos en Caliente HMR 📦 Empaquetado y optimización de recursos 🔄 Carga y mutaciones de...

react16-ssr

CVE-2018-6341 https://vulners.com/cve/CVE-2018-6341 A simple PoC to reproduce XSS vulnerability Steps npm i npm run start Go to localhost:3006...

Astro SSR - Open Redirect

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. id: CVE-2025-54793...

xwiki-cve-2025-24893

XWiki SolrSearch Unauthenticated RCE CVE-2025-24893 Contributors White Hat School 4th Cohort, Class 25 임두연@endusdksla Summary XWiki interprets wiki syntax and macros on the server side and renders them. The issue is that the Main.SolrSearch page is open to guests, yet it evaluates the user input...

CVE-2025-55182-Proof-of-Concept

CVE-2025-55182 概念実証 このリポジトリは、特定のサーバーサイドレンダリング実装におけるプロトタイプ汚染からリモートコード実行（RCE）に至る 脆弱性である CVE-2025-55182 の概念実証（PoC）を含んでいます。 ⚠️ 警告: このPoCは、教育、研究、および個人または管理された環境での許可されたセキュリティテストのみを目的としています。許可なくシステムで不正に使用することは違法です。 脆弱性の概要...

CVE-2026-16231

hbs , an Express view engine wrapping Handlebars, has a cross-site scripting vulnerability in its registerAsyncHelper API. An async helper returns an opaque placeholder during the first render pass, so Handlebars' double-brace escaping applies only to the placeholder. After rendering, hbs substit...

EUVD-2026-58727

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in...

PT-2026-72055

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in...

CVE-2026-73422

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-73422 Astro: Reflected XSS via unescaped View Transition animation properties

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

EUVD-2026-57606

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-73422

CVE-2026-73422 (Astro) : From 2.9.0 through 7.1.0, Astro’s server-side View Transition CSS generator serializes animation properties into an inline style element without escaping for CSS/HTML contexts. An attacker-controlled value (e.g., duration) can terminate the style element and inject arbitr...

PT-2026-71318

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

CVE-2026-65660

CVE-2026-65660 is a code injection vulnerability in Microsoft Office SharePoint that allows an authorized attacker to perform spoofing over a network, per the NVD entry. Microsoft's own advisory characterizes the impact as remote code execution . The Microsoft CNA CVSS 3.1 score is 8.8 (High) , w...

GHSA-F23P-VX2J-J53R Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Summary memo from hono/jsx retains the result of a server-side render and reuses it for later renders with comparator-equal props. Request-scoped values read inside the component take no part in that comparison, so a response can contain HTML rendered for another user's request. Details Component...

CVE-2026-71850

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...

CVE-2026-71850

Hono CVE-2026-71850 affects the Hono Web framework (3.8.0–4.12.33). memo() retains SSR output for later renders and reuses it when controls with identical props are rendered, while request-scoped values read during rendering (e.g., JSX Context via createContext/useContext, useRequestContext from ...

CVE-2026-71850 Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...