31 matches found
CVE-2025-70849
CVE-2025-70849: XSS Armazenado no Podinfo Resumo Uma vulnerabilidade de segurança CWE-79 foi identificada no Podinfo , uma aplicação web para demonstração de microsserviços Kubernetes. O recurso /store permite que usuários não autenticados enviem conteúdo HTML/JS arbitrário, resultando em XSS...
CVE-2025-70849-Podinfo
CVE-2025-70849: XSS persistente in Podinfo Riepilogo È stata identificata una vulnerabilità di sicurezza CWE-79 in Podinfo , un'applicazione web per la dimostrazione di microservizi Kubernetes. La funzionalità /store consente a utenti non autenticati di caricare contenuti HTML/JS arbitrari,...
Important: Red Hat Security Advisory: pcp security update
An update for pcp is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
UBUNTU-CVE-2026-16527
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...
CVE-2026-16527 Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...
PT-2026-66401
Name of the Vulnerable Software and Affected Versions PCP pmproxy affected versions not specified Description An unauthenticated remote attacker can bypass access controls by sending crafted requests to the '/store' endpoint. This allows the attacker to overwrite any PMDA metric, which can lead t...
EUVD-2026-43720
Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass...
CVE-2026-48016
Summary of findings (CVE-2026-48016) : The vulnerability in Shopware Store API allows an external Store API user, including guests, to trigger payments for another user’s order by supplying a foreign orderId to the endpoint /store-api/handle-payment. The root cause is that payment initiation/proc...
CVE-2026-52839
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and...
CVE-2026-52839 Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and...
CVE-2026-52839 Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and...
PYSEC-2026-1777 pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload
pgAdmin = 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end...
sharp 安全漏洞
Sharp is a personal development tool by Lovell, designed to convert large images in common formats into smaller, web-friendly JPEG, PNG, WebP, GIF, and AVIF images. Versions of Sharp from 9.0.0 to 9.22.3 contained a security vulnerability. This vulnerability stemmed from the create and store...
Flowise 安全漏洞
Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Versions of Flowise prior to 3.1.2 contained security vulnerabilities. These vulnerabilities stemmed from the lack of authentication and permission checks at the OpenAI Assistants Vector Store...
SUSE CVE-2025-70849
Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the store endpoint. An attacker can execute arbitrary scripts in the context of users by uploading specially crafted files that are rendered without proper content validation. Remediation There is no fixed...
GHSA-MW8W-Q3F7-2V85 Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)
Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...
Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)
Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...
CVE-2025-70849
Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy CSP or adequate Content-Type validation, leading to Stored...
