406 matches found
SUSE CVE-2025-68939
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API...
BIT-GITEA-2025-68939
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API...
BIT-GITEA-2025-68946
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS...
GO-2025-4261 Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea
Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea...
CVE-2025-68946
A flaw was found in Gitea. A remote attacker could exploit this vulnerability by injecting a forbidden URL scheme, such as javascript:, into a link. This could lead to Cross-Site Scripting XSS, allowing the attacker to execute arbitrary code in the user's browser or disclose sensitive information...
Gitea vulnerable to Cross-site Scripting
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS...
CVE-2025-68946
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS...
EUVD-2025-205421
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS...
Gitea allows attackers to add attachments with forbidden file extensions
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API...
GHSA-263Q-5CV3-XQ9G Gitea allows attackers to add attachments with forbidden file extensions
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API...
CVE-2025-68939
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API...
CVE-2025-68939
Issue : Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via the attachment API. Affected component : attachment handling API in Gitea. Root cause : insufficient validation in attachment editing APIs that permits disallowed exten...
EUVD-2025-205411
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API...
CVE-2025-68939
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API...
Gitea 安全漏洞
Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea versions prior to 1.23.0, which stems from allowing forbidden file extensions to be added via the Attachment API Edit Attachment Name...
PT-2025-53448
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.20.1 Description A flaw exists in Gitea that allows the use of a forbidden URL scheme, such as javascript:, within a link, which can lead to cross-site scripting XSS. Recommendations Update Gitea to version 1.20.1 or...
Django: Potential SQL Injection when annotating FilteredRelation on PostgreSQL
A potential SQL injection vulnerability was discovered in Django's annotation of FilteredRelation on PostgreSQL. The vulnerability was caused by an incomplete regular expression filter in the FORBIDDENALIASPATTERN. This allowed user input to be interpreted as raw strings, potentially enabling the...
CVE-2025-61907
Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information tha...