next_js_poisoning

CVE-2024-4698 — это уязвимость отравления кэша в Next.js, которая затрагивает версии с 13.5.1 по 13.5.7, а также с 14.0.0 по 14.2.10. Проблема возникает, когда веб-сайты используют API next/image?url= с параметром ?url=, что позволяет злоумышленникам загружать изображения, размещённые на их...

CVE-2025-50738-PoC

CVE-2025-50738 아주 간단합니다. SVG를 통한 저장형 XSS는 실제 환경에서 크로스 사이트 스크립팅을 찾는 매우 흔한 방법이므로, 제가 가장 먼저 시도한 것 중 하나였습니다. Pikapods를 통해 usememos를 배포한 후, 프론트 페이지로 이동하여 계정을 만들었습니다. 해당 계정으로 '생각'을 하나 만들었습니다. 그런 다음 다음 페이로드를 포함하는 SVG 파일을 만들었습니다. 이 페이로드는 JavaScript를 실행하여 'document.domain'을 출력합니다즉, '.pikapod.net'만 표시됩니다...

CVE-2026-96533 Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses...

CVE-2026-96533 Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses...

CVE-2026-63006

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-63006

Prior to version 7.1.2 , the Zammad helpdesk system is vulnerable to a security bypass where attacker-controlled HTML in inbound emails or tickets can circumvent the image URL sanitizer . By using path traversal sequences , an attacker can cause the browser to resolve a URL to a protected API end...

EUVD-2026-87270

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-56734

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-56734

The open-source helpdesk system Zammad (versions prior to 7.0.2 ) is vulnerable to Server-Side Request Forgery (SSRF) during federated authentication (OAuth/OIDC/SAML). The application fetches profile image URLs from external identity providers without validating the target address. An attacker c...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-63006: Improper Limitation of a Pathname to a Restricted Directory

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

PT-2026-99078

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An issue exists where attacker-controlled HTML in inbound emails or tickets can bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browse...

CVE-2026-49865 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-86780

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

EUVD-2026-75969

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

CVE-2026-86780

The Featured Image with URL WordPress plugin (versions before 1.0.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to properly sanitise and escape a stored image attribute value before outputting it. This allows users with a role as low as Contribu...

CVE-2026-86780 Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

WordPress Featured Image with URL plugin < 1.0.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Featured Image with URL versions 1.0.6...

PT-2026-89786

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...