19 matches found
CVE-2026-126779
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
EUVD-2026-123773
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
CVE-2026-126779
Spatie Browsershot versions 2.2.0 through 5.5.0 are vulnerable to a local file read vulnerability. The flaw exists because the setHtml() function allows attackers to supply root-relative references in HTML. By embedding elements such as iframe, img, link, or script that reference paths like /etc/...
CVE-2026-126779
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
CVE-2026-126779 Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
CVE-2026-126779 Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
PT-2026-145431
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
CVE-2026-126779: spatie browsershot: Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server…
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml. Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to...
PT-2026-78643
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorization code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...
CVE-2025-1022
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html, which can be bypassed by omitting the slashes in the file URI e.g., file:../../../../etc/passwd. This is due to missing validations of the use...
EUVD-2025-0240
Malicious code in bioql PyPI...
CVE-2025-1022
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html, which can be bypassed by omitting the slashes in the file URI e.g., file:../../../../etc/passwd. This is due to missing validations of the use...
CVE-2025-1022
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html, which can be bypassed by omitting the slashes in the file URI e.g., file:../../../../etc/passwd. This is due to missing validations of the use...
PT-2025-4134 · Spatie · Spatie/Browsershot
Name of the Vulnerable Software and Affected Versions: spatie/browsershot versions prior to 5.0.5 Description: The issue is related to improper input validation in the setHtml function, which can be bypassed by omitting slashes in the file URI, such as file:../../../../etc/passwd. This is due to...
CVE-2025-1022: Improper Input Validation
Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html, which can be bypassed by omitting the slashes in the file URI e.g., file:../../../../etc/passwd. This is due to missing validations of the use...
Improper Input Validation
Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html, which can be bypassed by omitting the slashes in the fil...
qt:qtbase_gui_text_qtextdocument_sethtml: Crash with empty stacktrace
Project: git://code.qt.io/qt/qt5.git Detailed Report: https://oss-fuzz.com/testcase?key=5214142815404032 Project: qt Fuzzing Engine: libFuzzer Fuzz Target: qtbaseguitextqtextdocumentsethtml Job Type: libfuzzerasanqt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fd39f316f60 Crash...
qt:qtbase_gui_text_qtextdocument_sethtml: Crash in void QtPrivate::QMovableArrayOps<QVariant>::emplace<QVariant>
Project: git://code.qt.io/qt/qt5.git Detailed Report: https://oss-fuzz.com/testcase?key=6219462548258816 Project: qt Fuzzing Engine: libFuzzer Fuzz Target: qtbaseguitextqtextdocumentsethtml Job Type: libfuzzerasani386qt Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0ffffff0 Crash...
qt:qtbase_gui_text_qtextdocument_sethtml: Crash with empty stacktrace
Project: git://code.qt.io/qt/qt5.git Detailed Report: https://oss-fuzz.com/testcase?key=4920551225294848 Project: qt Fuzzing Engine: libFuzzer Fuzz Target: qtbaseguitextqtextdocumentsethtml Job Type: libfuzzerasanqt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f5b6ee71f60 Crash...