CVE-2026-63642

A flaw was found in MagicMirror². A remote attacker can exploit an unauthenticated Socket.IO notification in the newsfeed module by providing a malicious, unvalidated URL. This allows for Server-Side Request Forgery SSRF, enabling the attacker to identify internal network hosts and ports, and...

CVE-2026-63642

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

EUVD-2026-61072

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

EUVD-2006-2140

Malware in sbrugna...

EUVD-2018-7548

Malware in sbrugna...

Description of the security update for SharePoint Server Subscription Edition: April 9, 2024 (KB5002581)

None None...

Description of the security update for SharePoint Enterprise Server 2016: March 12, 2024 (KB5002559)

None None...

SUSE CVE-2008-1761

Opera before 9.27 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted newsfeed source, which triggers an invalid memory access...

SUSE CVE-2013-4214

rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIECACHEON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on /tmp/magpiecache...

BTITeam XBTIT Cross-Site Scripting Vulnerability (CNVD-2019-28273)

XBTIT is an open source tracking software. A stored cross-site scripting vulnerability exists in newsfeed /index.php?page=viewnews in BTITeam XBTIT 2.5.4. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via the headline of a news item...

CVE-2018-15677

The newsfeed aka /index.php?page=viewnews in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF...

CVE-2018-15677

The newsfeed aka /index.php?page=viewnews in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF...

Amazon Linux AMI : nagios (ALAS-2017-899)

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service crash via a long string in the last key value in...

May 9, 2017—KB4019473 (OS Build 10586.916)

None None...

linksnet newsfeed 1.0 - Remote File Inclusion Vulnerability

No description provided by source. Linksnet Newsfeed =1.0 Remote file inclusion Download script : http://www.linksnet.de/mat/LinksnetNewsfeed10.zip Thanks Str0ke Exploit : http://victime.com/LinksnetNewsfeed10path/linksnetnewsfeed/linksnetlinkslogrss.php?dirpathlinksnetnewsfeed= shetll.txt?...

CVE-2013-4214

CVE-2013-4214 affects Nagios Core 3.4.4, 3.5.1 and earlier. The issue is a local symlink attack in rss-newsfeed.php: when MAGPIE_CACHE_ON is set to 1, a local attacker can create a symbolic link from a temporary file to a target file in /tmp/magpie_cache, enabling overwriting of arbitrary files w...

core: html/rss-newsfeed.php insecure temporary file usage

rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIECACHEON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on /tmp/magpiecache...

Quality Point 1.0 NewsFeed Cross Site Scripting / SQL Injection

sEc-r1z crEw The Leaders for Penetration Testing In Middle East. +===================================================================================+ ./SEC-R1Z / / / / /\ \ Demo :...