react16-ssr

CVE-2018-6341 https://vulners.com/cve/CVE-2018-6341 A simple PoC to reproduce XSS vulnerability Steps npm i npm run start Go to localhost:3006...

Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

Welcome to React Router! A modern, production-ready template for building full-stack React applications using React Router. Features 🚀 Server-side rendering ⚡️ Hot Module Replacement HMR 📦 Asset bundling and optimization 🔄 Data loading and mutations 🔒 TypeScript by default 🎉 TailwindCSS for stylin...

xwiki-cve-2025-24893

XWiki SolrSearch Unauthenticated RCE CVE-2025-24893 Contributors White Hat School 4th Cohort, Class 25 임두연@endusdksla Summary XWiki interprets wiki syntax and macros on the server side and renders them. The issue is that the Main.SolrSearch page is open to guests, yet it evaluates the user input...

Astro SSR - Open Redirect

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. id: CVE-2025-54793...

CVE-2026-126359

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when ends the template text or a preceding value and /...

CVE-2026-126359: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when element early and cause the remainder of the...

Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

Summary The css helper in hono/css escapes a / that follows element. The check only looks inside each value. When the text before a value ends with when that string starts with /style. During server-side rendering the element is closed early and the rest of the value is interpreted as HTML. This...

GHSA-3GG2-335M-RXC6 Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

Summary The css helper in hono/css escapes a / that follows element. The check only looks inside each value. When the text before a value ends with when that string starts with /style. During server-side rendering the element is closed early and the rest of the value is interpreted as HTML. This...

CVE-2026-126359 Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when ends the template text or a preceding value and /...

EUVD-2026-124740

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when ends the template text or a preceding value and /...

CVE-2026-126359

The Hono web framework is vulnerable to HTML injection in versions 3.12.0 through 4.13.15 due to an issue in the css helper . The helper improperly escapes interpolated values by processing them separately; if a template ends with < and an attacker-controlled value begins with /, the combined ...

CVE-2026-126359

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when element early and cause the remainder of the...

CVE-2026-126359 Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when ends the template text or a preceding value and /...

CVE-2020-27603-bbb-libreoffice-poc

CVE-2020-27603-bbb-libreoffice-poc Proof of Concept of Libreoffice file exfiltration vulnerability in Big Blue Button These ODT files show how to exploit a file exfiltration vulnerability that can happen with server-side Libreoffice rendering, e.g. BigBlueButton. Background:...

CVE-2025-55182-Proof-of-Concept

CVE-2025-55182 Proof-of-Concept This repository contains a Proof-of-Concept PoC for CVE-2025-55182 , a vulnerability involving Prototype Pollution leading to Remote Code Execution RCE in certain server‑side rendering implementations. ⚠️ Warning: This PoC is strictly for educational, research, and...

PT-2026-146081

Summary The css helper in hono/css escapes a / that follows element. The check only looks inside each value. When the text before a value ends with when that string starts with /style. During server-side rendering the element is closed early and the rest of the value is interpreted as HTML. This...

CVE-2026-111754

A flaw was found in @angular/platform-server. This vulnerability allows an unauthenticated remote attacker to trigger an open redirect, sending users to an attacker-controlled external domain. When server-side rendering SSR is enabled, validation checks for protocol-relative links occur before...

CVE-2026-111751

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each...

CVE-2026-101896

A flaw was found in @angular/router. When Server-Side Rendering SSR is enabled, the URL parser allocates disproportionate amounts of memory when handling numeric matrix parameters. An unauthenticated remote attacker can exploit this vulnerability by sending HTTP requests containing repeated numer...

CVE-2026-101895

A flaw was found in Angular's platform-server component. When performing Server-Side Rendering SSR, the HTML parser fails to properly handle malformed DOCTYPE declarations that end with trailing whitespace, leading to an infinite processing loop. A remote, unauthenticated attacker can exploit thi...