Cross-site Scripting (XSS)

miniflux.app is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the mediaProxy function of proxy.go due to the unescaped ServerError in proxy handler when opening a broken image, allowing an attacker to inject and execute malicious javascript...

CVE-2023-27592 Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler

Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the html.ServerError is returned unescaped without the expected Content Security Policy header added to...

Automattic: User Enumeration and Guessable User Account Attack on WORDPRESS

Hello, I found another bug on https://wordpress.com. Here any hacker can find out all registered users on wordpress.com. Here are the details of the same. How is wordpress.com is working? ============================ 1. You have Reset Password Page --...