Most recent entries from all

CLEANSTART-2025-JI63720 — Security fix for CVE-2025-30223 applied in: harbor-fips 2.11.2-r5

Affected: CleanStart: harbor-fips

Security vulnerability affects the harbor-fips package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-226338

fkie_cve-2025-30223

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.

GHSA-2j42-h78h-q4fg — Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input

Affected: Go: github.com/beego/beego/v2, Go: github.com/beego/beego

### Summary

A Cross-Site Scripting (XSS) vulnerability exists in Beego's `RenderForm()` function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's `RenderForm()` function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do).

### Details

The vulnerability is located in the `renderFormField()` function in Beego's `templatefunc.go` file (around lines 316-356). This function directly injects user-provided values into HTML without proper escaping:

```go return fmt.Sprintf(`%v<input%v%v name="%v" type="%v" value="%v"%v>`, label, id, class, name, fType, value, requiredString) ```

None of the values (label, id, class, name, value) are properly HTML-escaped before being inserted into the HTML template. This allows attackers to break out of the attribute context or inject HTML tags directly. The vulnerability can be exploited in two main ways:

- Attribute Injection: By injecting code into fields like DisplayName, an attacker can break out of the attribute context and execute JavaScript. - Content Injection: By injecting HTML tags into textarea content, an attacker can execute JavaScript.

The `Ren…

openSUSE-SU-2025:14970-1 — govulncheck-vulndb-0.0.20250402T160203-1.1 on GA media

govulncheck-vulndb-0.0.20250402T160203-1.1 on GA media