https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:42:54 +0000 https://cve.radiocsirt.org/vuln/cnvd-2025-22701 cnvd-2025-22701 https://cve.radiocsirt.org/vuln/cnvd-2025-22701 https://cve.radiocsirt.org/vuln/euvd-2026-245941 EUVD-2026-245941 https://cve.radiocsirt.org/vuln/euvd-2026-245941 https://cve.radiocsirt.org/vuln/fkie_cve-2025-52902 <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.</p> <p>File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-52902 https://cve.radiocsirt.org/vuln/ghsa-4wx8-5gm2-2j97 <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser</p> <p>## Summary ##</p> <p>The Markdown preview function of File Browser v2.32.0 is vulnerable to *Stored Cross-Site-Scripting (XSS)*. Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser</p> <p>## Impact ##</p> <p>A user can upload a malicious Markdown file to the application which can contain arbitrary HTML code. If another user within the same scope clicks on that file, a rendered preview is opened. JavaScript code that has been included will be executed.</p> <p>Malicious actions that are possible include: * Obtaining a user&#39;s session token * Elevating the attacker&#39;s privileges, if the victim is an administrator (e.g., gaining command execution rights)</p> <p>## Vulnerability Description ##</p> <p>Most Markdown parsers accept arbitrary HTML in a document and try rendering it accordingly. For instance, if one creates a file called `xss.md` with the following content:</p> <p>```markdown # Hallo</p> <p>&lt;b&gt;foo&lt;/b&gt;</p> <p>&lt;img src=&#34;xx&#34; onerror=alert(9)&gt; &lt;i&gt;bar&lt;/i&gt; ```</p> <p>Bold and italic text will be rendered. Also, the renderer used in File Browser will try to display the image and execute the code in the `onerror` event handler.</p> <p>## Proof of Concept ##</p> <p>The screenshot shows that the code from the file mentioned above has actually been executed in the victim&#39;s browser:</p> <p></p> <p>## Recommended Countermeasures ##</p> <p>The most thorough fix would be to reconf…</p> <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser</p> <p>## Summary ##</p> <p>The Markdown preview function of File Browser v2.32.0 is vulnerable to *Stored Cross-Site-Scripting (XSS)*. Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser</p> <p>## Impact ##</p> <p>A user can upload a malicious Markdown file to the application which can contain arbitrary HTML code. If another user within the same scope clicks on that file, a rendered preview is opened. JavaScript code that has been included will be executed.</p> <p>Malicious actions that are possible include: * Obtaining a user&#39;s session token * Elevating the attacker&#39;s privileges, if the victim is an administrator (e.g., gaining command execution rights)</p> <p>## Vulnerability Description ##</p> <p>Most Markdown parsers accept arbitrary HTML in a document and try rendering it accordingly. For instance, if one creates a file called `xss.md` with the following content:</p> <p>```markdown # Hallo</p> <p>&lt;b&gt;foo&lt;/b&gt;</p> <p>&lt;img src=&#34;xx&#34; onerror=alert(9)&gt; &lt;i&gt;bar&lt;/i&gt; ```</p> <p>Bold and italic text will be rendered. Also, the renderer used in File Browser will try to display the image and execute the code in the `onerror` event handler.</p> <p>## Proof of Concept ##</p> <p>The screenshot shows that the code from the file mentioned above has actually been executed in the victim&#39;s browser:</p> <p></p> <p>## Recommended Countermeasures ##</p> <p>The most thorough fix would be to reconf…</p> https://cve.radiocsirt.org/vuln/ghsa-4wx8-5gm2-2j97 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1 <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1