https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 15:40:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-327564 EUVD-2026-327564 https://cve.radiocsirt.org/vuln/euvd-2026-327564 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48518 <p>MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint (POST /multi-juicer/api/teams/{team}/join) accepted requests with any Content-Type, including text/plain. Because that content type does not trigger a CORS preflight, an attacker could host a cross-site HTML form that auto-submits to the endpoint and forces a victim&#39;s browser to log in as the attacker&#39;s team. A successful, undetected attacker can cause victims to unwittingly solve Juice Shop challenges under the attacker&#39;s team identity. In a CTF context this lets the attacker inflate their team&#39;s score using other players&#39; activity, and any sensitive data the victim enters into &#34;their&#34; Juice Shop ends up in the attacker&#39;s instance. The vulnerability is exploitable without any prior authentication; the victim only needs to visit a page the attacker controls while having network access to the MultiJuicer deployment. SameSite=Strict on the session cookie does not mitigate this, because the attack plants a new cookie rather than relying on an existing one. This issue was fixed in version 10.0.1.</p> <p>MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint (POST /multi-juicer/api/teams/{team}/join) accepted requests with any Content-Type, including text/plain. Because that content type does not trigger a CORS preflight, an attacker could host a cross-site HTML form that auto-submits to the endpoint and forces a victim&#39;s browser to log in as the attacker&#39;s team. A successful, undetected attacker can cause victims to unwittingly solve Juice Shop challenges under the attacker&#39;s team identity. In a CTF context this lets the attacker inflate their team&#39;s score using other players&#39; activity, and any sensitive data the victim enters into &#34;their&#34; Juice Shop ends up in the attacker&#39;s instance. The vulnerability is exploitable without any prior authentication; the victim only needs to visit a page the attacker controls while having network access to the MultiJuicer deployment. SameSite=Strict on the session cookie does not mitigate this, because the attack plants a new cookie rather than relying on an existing one. This issue was fixed in version 10.0.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48518