react16-ssr

CVE-2018-6341 https://vulners.com/cve/CVE-2018-6341 A simple PoC to reproduce XSS vulnerability Steps npm i npm run start Go to localhost:3006...

Astro SSR - Open Redirect

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. id: CVE-2025-54793...

CVE-2020-27603-bbb-libreoffice-poc

CVE-2020-27603-bbb-libreoffice-poc Big Blue Button에서 Libreoffice 파일 유출 취약점에 대한 개념 증명 이 ODT 파일들은 서버 측 Libreoffice 렌더링예: BigBlueButton에서 발생할 수 있는 파일 유출 취약점을 악용하는 방법을 보여줍니다. 배경: https://blog.hboeck.de/archives/902-File-Exfiltration-via-Libreoffice-in-BigBlueButton-and-JODConverter.html...

Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

React Router へようこそ! React Router を使用したフルスタック React アプリケーションを構築するための、モダンで本番環境に対応したテンプレートです。 特徴 🚀 サーバーサイドレンダリング ⚡️ ホットモジュールリプレイスメント（HMR） 📦 アセットのバンドルと最適化 🔄 データのロードとミューテーション 🔒 デフォルトで TypeScript 🎉 スタイリングに TailwindCSS 📖 React Router ドキュメント はじめに インストール 依存関係をインストールします: root@kitploit: npm install 開発 HMR...

xwiki-cve-2025-24893

XWiki SolrSearch Unauthenticated RCE CVE-2025-24893 Contributors 화이트햇 스쿨 4기 25반 임두연@endusdksla 요약 XWiki는 위키 문법과 매크로를 서버 측에서 해석해 렌더링한다. 문제는 Main.SolrSearch 페이지가 게스트에게 열려 있으면서도, 사용자 입력인 text 파라미터를 충분한 검증 없이 XWiki 문법으로 평가한다는 점이다. 공격자는 text에 groovy 매크로를 삽입해 서버에서 임의의 Groovy 코드를 실행할 수 있고,...

Linux Distros Unpatched Vulnerability : CVE-2026-88058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, a...

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization when traversing ancestor tags across element boundaries. When an application renders untrusted user input within raw-text tags , , , comments, or text nodes inside a that is nested...

CVE-2026-88060

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes untrusted input inside template content nested in...

DEBIAN-CVE-2026-88058

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback...

CVE-2026-88058

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback...

CVE-2026-88060

Angular server-side rendering in @angular/platform-server (prior to 20.3.30, 21.2.22, and 22.1.4) serializes untrusted input inside content nested in fallback raw-content elements such as noscript , iframe , noembed , and noframes . The Domino serializer's fallbackRawContentTags traversal stoppe...

CVE-2026-88060 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes untrusted input inside template content nested in...

CVE-2026-88059

Angular's @angular/common HttpTransferCache can leak authenticated responses when Server-Side Rendering uses a hierarchical HttpClient with withRequestsMadeViaParent. The child TransferCache evaluates a request as anonymous before a parent interceptor injects credentials (Authorization header, co...

CVE-2026-88056

Angular's @angular/platform-server is vulnerable to SSRF and cross-origin credential disclosure prior to versions 20.3.30, 21.2.22, and 22.1.4 . The root cause is that the resolveUrl and parseUrl utilities invoked String.prototype.trim(), which strips leading Unicode whitespace (e.g. U+00A0, U+FE...

PT-2026-89700

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization when traversing ancestor tags across element boundaries. When an application renders untrusted user input within raw-text tags , , , comments, or text nodes inside a that is nested...

CVE-2025-55182-Proof-of-Concept

CVE-2025-55182 概念実証 このリポジトリは、特定のサーバーサイドレンダリング実装におけるプロトタイプ汚染からリモートコード実行（RCE）に至る 脆弱性である CVE-2025-55182 の概念実証（PoC）を含んでいます。 ⚠️ 警告: このPoCは、教育、研究、および個人または管理された環境での許可されたセキュリティテストのみを目的としています。許可なくシステムで不正に使用することは違法です。 脆弱性の概要...

CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-16231

hbs , an Express view engine wrapping Handlebars, has a cross-site scripting vulnerability in its registerAsyncHelper API. An async helper returns an opaque placeholder during the first render pass, so Handlebars' double-brace escaping applies only to the placeholder. After rendering, hbs substit...

EUVD-2026-58727

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in...

PT-2026-72055

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in...