https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 03:55:21 +0000 https://cve.radiocsirt.org/vuln/cve-2025-4673 <p><strong>Affected:</strong> Go standard library net/http</p> <p>Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.</p> <p><strong>Affected:</strong> Go standard library net/http</p> <p>Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.</p> https://cve.radiocsirt.org/vuln/cve-2025-4673 https://cve.radiocsirt.org/vuln/ghsa-2j42-h78h-q4fg <p><strong>Affected:</strong> Go: github.com/beego/beego/v2, Go: github.com/beego/beego</p> <p>### Summary</p> <p>A Cross-Site Scripting (XSS) vulnerability exists in Beego&#39;s `RenderForm()` function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims&#39; browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego&#39;s `RenderForm()` function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do).</p> <p>### Details</p> <p>The vulnerability is located in the `renderFormField()` function in Beego&#39;s `templatefunc.go` file (around lines 316-356). This function directly injects user-provided values into HTML without proper escaping:</p> <p>```go return fmt.Sprintf(`%v&lt;input%v%v name=&#34;%v&#34; type=&#34;%v&#34; value=&#34;%v&#34;%v&gt;`, label, id, class, name, fType, value, requiredString) ```</p> <p>None of the values (label, id, class, name, value) are properly HTML-escaped before being inserted into the HTML template. This allows attackers to break out of the attribute context or inject HTML tags directly. The vulnerability can be exploited in two main ways:</p> <p>- Attribute Injection: By injecting code into fields like DisplayName, an attacker can break out of the attribute context and execute JavaScript. - Content Injection: By injecting HTML tags into textarea content, an attacker can execute JavaScript.</p> <p>The `Ren…</p> <p><strong>Affected:</strong> Go: github.com/beego/beego/v2, Go: github.com/beego/beego</p> <p>### Summary</p> <p>A Cross-Site Scripting (XSS) vulnerability exists in Beego&#39;s `RenderForm()` function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims&#39; browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego&#39;s `RenderForm()` function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do).</p> <p>### Details</p> <p>The vulnerability is located in the `renderFormField()` function in Beego&#39;s `templatefunc.go` file (around lines 316-356). This function directly injects user-provided values into HTML without proper escaping:</p> <p>```go return fmt.Sprintf(`%v&lt;input%v%v name=&#34;%v&#34; type=&#34;%v&#34; value=&#34;%v&#34;%v&gt;`, label, id, class, name, fType, value, requiredString) ```</p> <p>None of the values (label, id, class, name, value) are properly HTML-escaped before being inserted into the HTML template. This allows attackers to break out of the attribute context or inject HTML tags directly. The vulnerability can be exploited in two main ways:</p> <p>- Attribute Injection: By injecting code into fields like DisplayName, an attacker can break out of the attribute context and execute JavaScript. - Content Injection: By injecting HTML tags into textarea content, an attacker can execute JavaScript.</p> <p>The `Ren…</p> https://cve.radiocsirt.org/vuln/ghsa-2j42-h78h-q4fg