https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T01:11:20.555260+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-36446 EUVD-2026-36446 2026-10-07T01:11:20.560019+00:00 EUVD-2026-36446 https://cve.radiocsirt.org/vuln/fkie_cve-2020-5223 fkie_cve-2020-5223 2026-10-07T01:11:20.560053+00:00

In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.

 https://cve.radiocsirt.org/vuln/ghsa-8j72-p2wm-6738 GHSA-8j72-p2wm-6738 — Persistent XSS vulnerability in filename of attached file in PrivateBin 2026-10-07T01:11:20.560085+00:00

Affected: Packagist: privatebin/privatebin

On 24th of December 2019 one of the [property based unit tests](https://github.com/PrivateBin/PrivateBin/blob/master/tst/README.md#property-based-unit-testing) reported a [failure](https://travis-ci.org/PrivateBin/PrivateBin/jobs/629180605#L782). Upon investigation, [@elrido](https://github.com/elrido) discovered that the failure was due to unescaped HTML, which allowed the user provided attachment file name to inject HTML under certain conditions leading to a persistent [Cross-site scripting (XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting) vulnerability. After committing an [initial fix](https://github.com/PrivateBin/PrivateBin/commit/8d0ac336d23cd8c98e71d5f21cdadcae9c8a26e6) to the master branch, the [issue was reported](https://github.com/PrivateBin/PrivateBin/issues/554) on 25th of December. Vulnerability write-up done by [@rugk](https://github.com/rugk) and [@elrido](https://github.com/elrido). The vulnerability has been fixed in [PrivateBin v1.3.2 & v1.2.2](https://privatebin.info/news/v1.3.2-v1.2.2-release.html). Admins are urged to upgrade to these versions to protect the affected users.

## Affected versions

Any PrivateBin version since 1.2.

## Conditions

* The configuration setting `fileupload` has to be enabled, as 1.3 displays an error when trying to open a paste with attachment. * The CSP header rules don't get applied. For example: * They are unsupported or disabled in the visitors browser. * They are filtered out by a some proxy server at th…

 https://cve.radiocsirt.org/vuln/gsd-2020-5223 gsd-2020-5223 2026-10-07T01:11:20.560175+00:00 gsd-2020-5223