https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:18:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-239198 EUVD-2026-239198 https://cve.radiocsirt.org/vuln/euvd-2026-239198 https://cve.radiocsirt.org/vuln/fkie_cve-2024-52290 <p>LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key `Name` (`confKey`) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim&#39;s browser. Version 2.1.0 fixes the issue.</p> <p>LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key `Name` (`confKey`) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim&#39;s browser. Version 2.1.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-52290 https://cve.radiocsirt.org/vuln/ghsa-9cwv-pxcr-hfjc <p><strong>Affected:</strong> Go: github.com/lf-edge/ekuiper, Go: github.com/lf-edge/ekuiper/v2</p> <p>### Summary Stored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users&#39; browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.</p> <p>### Details A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Connection Configuration key `Name` (`confKey`) parameter. Then, after any user with access to this service (e.g. admin) will try to delete this key, a payload will act in victim&#39;s browser.</p> <p>### PoC 1. Authorize as a user with rights to modificate the service (e.g. kuiperUser role). 2. Create a service or go to the existing one and access the *Configuration &gt; Connection* page:</p> <p></p> <p>3. Open any existing Connection and press on `Add configuration key`:</p> <p></p> <p>4. Set any name and Address, then intercept the request and add the following payload to the `confKey` parameter: `123%3Cimg%20src=1%20onerror%3dalert%281%29%3E`:</p> <p></p> <p>5. A new configuration key then will be set:</p> <p> vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users&#39; browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.</p> <p>### Details A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Connection Configuration key `Name` (`confKey`) parameter. Then, after any user with access to this service (e.g. admin) will try to delete this key, a payload will act in victim&#39;s browser.</p> <p>### PoC 1. Authorize as a user with rights to modificate the service (e.g. kuiperUser role). 2. Create a service or go to the existing one and access the *Configuration &gt; Connection* page:</p> <p></p> <p>3. Open any existing Connection and press on `Add configuration key`:</p> <p></p> <p>4. Set any name and Address, then intercept the request and add the following payload to the `confKey` parameter: `123%3Cimg%20src=1%20onerror%3dalert%281%29%3E`:</p> <p></p> <p>5. A new configuration key then will be set:</p> <p>![image](https://github.com/user-attachments/assets/43b75f1e-81ac-48…</p> https://cve.radiocsirt.org/vuln/ghsa-9cwv-pxcr-hfjc https://cve.radiocsirt.org/vuln/opensuse-su-2025:15135-1 <p>govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15135-1