CVE-2026-40302

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template which performs no HTML escaping instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the...

CVE-2026-40302

CVE-2026-40302 affects zrok prior to v2.0.1. The proxyUi template engine used Go's text/template (no HTML escaping), leading to reflected XSS via an attacker-controlled refreshInterval error rendered in the GitHub OAuth callback. An attacker can send a crafted login URL; after OAuth completes, th...

zrok 安全漏洞

Zrok is a secure internet sharing tool developed by OpenZiti. Versions of Zrok prior to 2.0.1 contained security vulnerabilities; these vulnerabilities stemmed from a lack of upper limit checks on the number of cookie blocks, which could lead to denial-of-service attacks...

zrok 安全漏洞

Zrok is a secure internet sharing tool developed by OpenZiti. Versions of Zrok prior to 2.0.1 contained security vulnerabilities. These vulnerabilities stemmed from logical errors in the unaccess processor, which could allow non-administrator users to delete the global frontend...

zrok 安全漏洞

Zrok is a secure internet sharing tool developed by OpenZiti. Versions of Zrok prior to 2.0.1 contained security vulnerabilities. These vulnerabilities stemmed from the use of the text/template template engine without proper escaping of the refreshInterval parameter, which could lead to cross-sit...

Unfixed XSS vulnerability at www.kunst.ag

Security researcher zrok, has submitted on 23/09/2010 a cross-site-scripting XSS vulnerability affecting www.kunst.ag, which at the time of submission ranked 828146 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 15/12/2011. It is currently...

Unfixed XSS vulnerability at www.tripwolf.com

Security researcher zrok, has submitted on 28/12/2008 a cross-site-scripting XSS vulnerability affecting www.tripwolf.com, which at the time of submission ranked 15610 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/06/2009. It is currently...