45 matches found
CVE-2025-70849
CVE-2025-70849: XSS almacenado en Podinfo Resumen Se identificó una vulnerabilidad de seguridad CWE-79 en Podinfo , una aplicación web para demostrar microservicios de Kubernetes. La funcionalidad /store permite a usuarios no autenticados cargar contenido HTML/JS arbitrario, lo que conduce a XSS...
CVE-2025-70849-Podinfo
CVE-2025-70849: XSS Almacenado en Podinfo Resumen Se identificó una vulnerabilidad de seguridad CWE-79 en Podinfo , una aplicación web para demostrar microservicios en Kubernetes. La funcionalidad /store permite a usuarios no autenticados cargar contenido arbitrario en HTML/JS, lo que provoca XSS...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: steampipe, victorialogs, flux-source-controller, podinfo, flux-operator, aws-ebs-csi-driver, dkron, amazon-k8s-cni-fips, victoriametrics-cluster-fips, nova-fips, flux-image-reflector-controller, temporal-fips, flux-image-automation-controller, flux-fips,...
GO-2026-5039 vulnerabilities
Vulnerabilities for packages: kots, apisix-ingress-controller, wuzz, skopeo, bento, dapr, container-object-storage-interface, kubescape-operator, stakater-reloader, crossplane-provider-aws-cloudformation, trufflehog, grafana-alloy, cluster-api-ipam-provider-in-cluster, grafana, k9s,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: step-kms-plugin, wuzz, traefik, bento, kubescape-operator, container-object-storage-interface, ferretdb, stakater-reloader, crossplane-provider-aws-cloudformation, git-sync, cluster-api-ipam-provider-in-cluster, manifest-tool, kubernetes-csi-livenessprobe,...
GO-2026-5560 podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo
podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo...
CVE-2026-43644
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
Exploit for Unrestricted Upload of File with Dangerous Type in Stefanprodan Podinfo
CVE-2025-70849: Stored XSS in Podinfo Summary A security v...
podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
GHSA-Q23M-VM9R-5745 podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
EUVD-2026-30275
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
CVE-2026-43644
CVE-2026-43644 affects podinfo up to version 6.11.2. The vulnerability is a reflected XSS in the /echo and /api/echo endpoints, caused by the echoHandler writing the request body to the response without setting explicit Content-Type or X-Content-Type-Options headers. Go’s content-type detection m...
CVE-2026-43644 podinfo 6.11.2 Reflected XSS via /echo Endpoint
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin...
PT-2026-40911
Name of the Vulnerable Software and Affected Versions podinfo versions prior to 6.11.3 Description A reflected cross-site scripting issue exists in the '/echo' and '/api/echo' endpoints. The echoHandler function writes request body content directly to the response without setting explicit...
podinfo 跨站脚本漏洞
Podinfo is a Kubernetes microservice template developed by Stefan Prodan. Versions of Podinfo 6.11.2 and earlier contained a cross-site scripting vulnerability. This vulnerability stemmed from the fact that the echoHandler did not set a clear Content-Type or X-Content-Type-Options header on the...