59 matches found
UBUNTU-CVE-2025-31483
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed...
CVE-2025-31483
The CVE-2025-31483 vulnerability affects Miniflux (a feed reader) where a weak Content Security Policy on the /proxy/* route allowed bypassing the media proxy CSP and executing cross-site scripting when external images were opened in a new tab/window. Root cause: insufficient CSP controls for the...
CVE-2025-31483 Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed...
CVE-2025-31483 Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed...
CVE-2025-31483 Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed...
Miniflux 跨站脚本漏洞
Miniflux is a minimalist synopsis reader open-sourced by Miniflux. Miniflux suffers from a cross-site scripting vulnerability that stems from a weak content security policy in the media proxy and could lead to cross-site scripting...
CVE-2025-31483: Improper Neutralization of Input During Web Page Generation
Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed...
PT-2025-6250 · Concorde · Concorde
Name of the Vulnerable Software and Affected Versions: Concorde versions prior to 12.25Q1.1 Description: The issue arises from a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, allowing an attacker to bypass MediaProxy authentication. This enables the...
Concorde 跨站请求伪造漏洞
Concorde Nexkey is an application by nexryai individual developers. A cross-site request forgery vulnerability exists in Concorde version 12.24Q4.2, which stems from a lack of CSRF countermeasures and improper cookie settings, and could allow an attacker to bypass MediaProxy authentication to loa...
CVE-2024-56200
CVE-2024-56200 affects Altair (fork of Misskey v12). Affected versions lack request validation and authentication in the image proxy used for compressing/resizing remote files, enabling attacks that can degrade availability by spiking CPU or network load. The issue is fixed in v12.24Q4.1; upgradi...
CVE-2024-49363 Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey
Misskey is an open source, federated social media platform. In affected versions FileServerService media proxy in github.com/misskey-dev/misskey 2024.10.1 or earlier did not detect proxy loops, which allows remote actors to execute a self-propagating reflected/amplified distributed...
Cross-site Scripting (XSS)
rsshub is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the internal media proxy failing to sanitize specially crafted images, which allows an attacker to upload an image resulting in XSS. This allows for the execution of arbitrary JavaScript code. Users accessing a...
CVE-2024-27926 RSSHub Cross-site Scripting vulnerability caused by internal media proxy
RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of...
CVE-2024-27926 RSSHub Cross-site Scripting vulnerability caused by internal media proxy
RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of...
CVE-2024-27926
RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of...
RSSHub Cross-site Scripting vulnerability caused by internal media proxy
Impact When the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. Patches This vulnerability was fixed...
GHSA-2WQW-HR4F-XRHH RSSHub Cross-site Scripting vulnerability caused by internal media proxy
Impact When the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. Patches This vulnerability was fixed...
PT-2024-22141
Name of the Vulnerable Software and Affected Versions RSSHub versions 1.0.0-master.cbbd829 through 1.0.0-master.d8ca915 Description RSSHub is an open source RSS feed generator. When a specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS...
CVE-2024-27926: Improper Neutralization of Input During Web Page Generation
RSSHub is an open source RSS feed generator. Starting in version 1.0.0-master.cbbd829 and prior to version 1.0.0-master.d8ca915, ahen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of...