CVE-2020-27603-bbb-libreoffice-poc

CVE-2020-27603-bbb-libreoffice-poc Preuve de concept de la vulnérabilité d'exfiltration de fichiers Libreoffice dans Big Blue Button Ces fichiers ODT montrent comment exploiter une vulnérabilité d'exfiltration de fichiers qui peut survenir lors du rendu Libreoffice côté serveur, par exemple...

Astro SSR - Open Redirect

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. id: CVE-2025-54793...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

CVE-2025-55182-Proof-of-Concept

CVE-2025-55182 Preuve de concept Ce dépôt contient une preuve de concept PoC pour CVE-2025-55182 , une vulnérabilité impliquant une pollution de prototype menant à une exécution de code à distance RCE dans certaines implémentations de rendu côté serveur. ⚠️ Avertissement : Cette PoC est strictemen...

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

Infinite loop

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Infinite loop via the afterdoctypenamestate handler in Domino's HTML parser lib/HTMLParser.js, used by @angular/platform-server for server-side rendering. Whe...

EUVD-2026-75681

Angular SSR: XSS via Unescaped Processing Instruction Nodes in Fallback Raw-Content Elements...

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization of ProcessingInstruction DOM nodes , nodeType === 7 when nested inside fallback raw-content elements , , , . While processing instruction data escaped to , it did not check for or...

react16-ssr

CVE-2018-6341 https://vulners.com/cve/CVE-2018-6341 Un simple PoC pour reproduire la vulnérabilité XSS Étapes npm i npm run start Aller sur localhost:3006...

Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

Добро пожаловать в React Router! Современный шаблон, готовый к продакшену, для создания полнофункциональных React-приложений с использованием React Router. Возможности 🚀 Серверный рендеринг ⚡️ Горячая замена модулей HMR 📦 Сборка и оптимизация ресурсов 🔄 Загрузка данных и мутации 🔒 TypeScript по...

xwiki-cve-2025-24893

XWiki SolrSearch RCE non authentifiée CVE-2025-24893 Contributeurs École Whitehat 4e promotion, classe 25 Im Duyeon@endusdksla Résumé XWiki interprète et rend la syntaxe wiki et les macros côté serveur. Le problème est que la page Main.SolrSearch est ouverte aux invités tout en évaluant le...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

Linux Distros Unpatched Vulnerability : CVE-2026-93981

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an...

CVE-2026-93981

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hxh3-vqpv-xpqv. This link is maintained to preserve external references. Original Description hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a...

CVE-2026-93981

hono/jsx (a server-side rendering component of the hono web framework) before version 4.13.7 fails to HTML-escape plain strings in several rendering paths: child or fallback of Suspense , string child of ErrorBoundary alongside an async sibling, the single child of Context.Provider , and the root...

CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString or renderToReadableStream...