45 matches found
CVE-2025-70849
CVE-2025-70849: XSS Memorizzato in Podinfo Riepilogo Una vulnerabilità di sicurezza CWE-79 è stata identificata in Podinfo , un'applicazione web per dimostrare microservizi Kubernetes. La funzionalità /store consente a utenti non autenticati di caricare contenuti HTML/JS arbitrari, portando a XSS...
CVE-2025-70849-Podinfo
CVE-2025-70849: XSS persistente in Podinfo Riepilogo È stata identificata una vulnerabilità di sicurezza CWE-79 in Podinfo , un'applicazione web per la dimostrazione di microservizi Kubernetes. La funzionalità /store consente a utenti non autenticati di caricare contenuti HTML/JS arbitrari,...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: polaris, aws-ebs-csi-driver-fips, go, amazon-k8s-cni-fips, flux-fips, metacontroller, victoriametrics-fips, flux-source-watcher, stakater-reloader, grafana-fips, flux-operator-fips, nova, grafana-operator, pgwatch, podinfo, victoriametrics-cluster-fips,...
GO-2026-5039 vulnerabilities
Vulnerabilities for packages: cluster-autoscaler, cert-manager, harbor-registry, k3s, knative-serving, litestream, policy-controller, chisel, temporal-server, vcluster, addon-resizer, crossplane-provider-aws-dynamodb, external-secrets-operator, istio, pulumi-kubernetes-operator,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: nri-postgresql, cluster-autoscaler, harbor-registry, policy-controller, cosign, k3s, litestream, nerdctl, chisel, influx, git-sync, thanos-operator, crossplane-provider-aws-dynamodb, kube-vip-cloud-provider, kubernetes-dashboard-api, kapp, kuberay-operator,...
GO-2026-5560 podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo
podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo...
CVE-2026-43644
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
Exploit for Unrestricted Upload of File with Dangerous Type in Stefanprodan Podinfo
CVE-2025-70849: Stored XSS in Podinfo Summary A security v...
podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
GHSA-Q23M-VM9R-5745 podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
EUVD-2026-30275
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644
CVE-2026-43644 affects podinfo up to version 6.11.2. The vulnerability is a reflected XSS in the /echo and /api/echo endpoints, caused by the echoHandler writing the request body to the response without setting explicit Content-Type or X-Content-Type-Options headers. Go’s content-type detection m...
PT-2026-40911
Name of the Vulnerable Software and Affected Versions podinfo versions prior to 6.11.3 Description A reflected cross-site scripting issue exists in the '/echo' and '/api/echo' endpoints. The echoHandler function writes request body content directly to the response without setting explicit...
podinfo 跨站脚本漏洞
Podinfo is a Kubernetes microservice template developed by Stefan Prodan. Versions of Podinfo 6.11.2 and earlier contained a cross-site scripting vulnerability. This vulnerability stemmed from the fact that the echoHandler did not set a clear Content-Type or X-Content-Type-Options header on the...