Contentful <=2020-05-21 - Cross-Site Scripting

Contentful through 2020-05-21 for Python contains a reflected cross-site scripting vulnerability via the api parameter to the-example-app.py. id: CVE-2020-13258 info: name: Contentful alert...

cirrusgo

CirrusGo Uno strumento veloce per scansionare app SAAS, PAAS scritto in Go Supporto per app SAAS : salesforce contentful prossima versione Nota: il flag -o per l'output non funziona installazione : golang 1.18Ver root@kitploit: go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest or go...

CVE-2026-53957

creationtimestamp| type| source ---|---|--- 2026-08-19 20:35:15+00:00| published-proof-of-concept| https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx...

GHSA-2XHG-73J7-RRGX Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Summary exportspace and importspace tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — t...

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Summary exportspace and importspace tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — t...

MAL-2026-11841 Malicious code in @servicetitan/contentful (npm)

npm/@servicetitan/contentful is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11842 Malicious code in @servicetitan/contentful-proxy (npm)

npm/@servicetitan/contentful-proxy is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

PYSEC-2026-626 Cross-site scripting in Contentful

Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py...

EUVD-2021-1319

Malware in sbrugna...

Malicious code in contentful-app-entry-localization-matrix (npm)

The package contentful-app-entry-localization-matrix was found to contain malicious code...

MAL-2025-41957 Malicious code in contentful-app-entry-localization-matrix (npm)

The package contentful-app-entry-localization-matrix was found to contain malicious code...

Malicious code in contentful-build-bot (npm)

The package contentful-build-bot was found to contain malicious code...

MAL-2025-26204 Malicious code in mericsson-gatsby-source-contentful (npm)

The package mericsson-gatsby-source-contentful was found to contain malicious code...

Malicious code in mericsson-gatsby-source-contentful (npm)

The package mericsson-gatsby-source-contentful was found to contain malicious code...

MAL-2025-17515 Malicious code in contentful-build-bot (npm)

The package contentful-build-bot was found to contain malicious code...

CVE-2020-13258

Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py...

@baseline-ui/app (0.22.1), @baseline-ui/core (0.22.1) +109 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=22.0.0, <=36.3.9)

@udecode/plate-core NPM version =22.0.0, =3.11.0, =0.1.0, =5.1.1, =0.0.1, =0.0.1, =0.0.2, =12.0.0-beta.405, =0.34.0, =0.9.7, =0.0.23, =0.2.8, =0.3.45 and more Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...

Malicious code in chegg-contentful (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0f294558304bba4da1c74169d026ebb78d4c1509bc734739942abe3860bc7390 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ossf-package-analysis...

Cirrusgo - A Fast Tool To Scan SAAS, PAAS App Written In Go

A fast tool to scan SAAS,PAAS App written in Go SAAS App Support : salesforce contentful next version Note flag -o output not working install : golang 1.18Ver go install -v github.com/Ph33rr/cirrusgo/cmd/cirrusgo@latest or go install -v github.com/Ph33rr/CirrusGo/cmd/cirrusgo@latest Help: cirrusg...

contentful-import (5.0.2-beta1), http_bouncer_client (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2019-10196 via http-proxy-agent (2.0.0)

http-proxy-agent NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on http-proxy-agent and may be impacted: - contentful-import 5.0.2-beta1 - httpbouncerclient =1.0.1, =1.0.3 - request-light 0.2.2 Source cves: CVE-2019-10196 Source advisor...