https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T03:55:58.492924+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-4673 CVE-2025-4673 — Sensitive headers not cleared on cross-origin redirect in net/http 2026-10-06T03:55:58.499981+00:00

Affected: Go standard library net/http

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

 https://cve.radiocsirt.org/vuln/ghsa-2j42-h78h-q4fg GHSA-2j42-h78h-q4fg — Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input 2026-10-06T03:55:58.500038+00:00

Affected: Go: github.com/beego/beego/v2, Go: github.com/beego/beego

### Summary

A Cross-Site Scripting (XSS) vulnerability exists in Beego's `RenderForm()` function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's `RenderForm()` function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do).

### Details

The vulnerability is located in the `renderFormField()` function in Beego's `templatefunc.go` file (around lines 316-356). This function directly injects user-provided values into HTML without proper escaping:

```go return fmt.Sprintf(`%v<input%v%v name="%v" type="%v" value="%v"%v>`, label, id, class, name, fType, value, requiredString) ```

None of the values (label, id, class, name, value) are properly HTML-escaped before being inserted into the HTML template. This allows attackers to break out of the attribute context or inject HTML tags directly. The vulnerability can be exploited in two main ways:

- Attribute Injection: By injecting code into fields like DisplayName, an attacker can break out of the attribute context and execute JavaScript. - Content Injection: By injecting HTML tags into textarea content, an attacker can execute JavaScript.

The `Ren…