CVE-2021-21278

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

CVE-2021-21278: Improper Neutralization of Special Elements in Output Used by a Downstream Component

RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...

Zomato: Login to any account with the emailaddress

Introduction An attacker just needs to supply an email address to gain a valid access token for the Zomato applications. Thus any account on Zomato can be fully accessed with just the email address. Endpoint /v2/auth.json Impact Critical, without any user interaction an attacker can access any...