https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:13:47 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-103388 <p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p> <p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p> <p>Preconditions:</p> <p>- Attacker must hold galaxy editor privileges (local or via sync).</p> <p>- Victim must view the affected cluster and click the malicious link.</p> <p>Impact:</p> <p>- Stored cross-site scripting (XSS) in the victim&#39;s browser.</p> <p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p> <p>Affected: &lt;2.5.48.</p> <p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p> <p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p> <p>Preconditions:</p> <p>- Attacker must hold galaxy editor privileges (local or via sync).</p> <p>- Victim must view the affected cluster and click the malicious link.</p> <p>Impact:</p> <p>- Stored cross-site scripting (XSS) in the victim&#39;s browser.</p> <p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p> <p>Affected: &lt;2.5.48.</p> https://db.gcve.eu/vuln/fkie_cve-2026-103388 https://db.gcve.eu/vuln/gcve-1-2026-20256 <p><strong>Affected:</strong> MISP</p> <p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p> <p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p> <p>Preconditions:</p> <p>- Attacker must hold galaxy editor privileges (local or via sync).</p> <p>- Victim must view the affected cluster and click the malicious link.</p> <p>Impact:</p> <p>- Stored cross-site scripting (XSS) in the victim&#39;s browser.</p> <p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p> <p>Affected: &lt;2.5.48.</p> <p><strong>Affected:</strong> MISP</p> <p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p> <p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p> <p>Preconditions:</p> <p>- Attacker must hold galaxy editor privileges (local or via sync).</p> <p>- Victim must view the affected cluster and click the malicious link.</p> <p>Impact:</p> <p>- Stored cross-site scripting (XSS) in the victim&#39;s browser.</p> <p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p> <p>Affected: &lt;2.5.48.</p> https://db.gcve.eu/vuln/gcve-1-2026-20256 https://db.gcve.eu/vuln/ghsa-ccjm-jpcq-p5hf <p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p> <p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p> <p>Preconditions:</p> <p>- Attacker must hold galaxy editor privileges (local or via sync).</p> <p>- Victim must view the affected cluster and click the malicious link.</p> <p>Impact:</p> <p>- Stored cross-site scripting (XSS) in the victim&#39;s browser.</p> <p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p> <p>Affected: &lt;2.5.48.</p> <p>MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.</p> <p>When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.</p> <p>Preconditions:</p> <p>- Attacker must hold galaxy editor privileges (local or via sync).</p> <p>- Victim must view the affected cluster and click the malicious link.</p> <p>Impact:</p> <p>- Stored cross-site scripting (XSS) in the victim&#39;s browser.</p> <p>- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.</p> <p>Affected: &lt;2.5.48.</p> https://db.gcve.eu/vuln/ghsa-ccjm-jpcq-p5hf