Résumé
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Références
Vulnérabilités liées
Tout Supply chain →- HIGHGHSA-V2WW-5RH7-2H5V
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
- LOWGHSA-68XW-R643-9P5W
OpenClaw: Skill-command dispatch could skip before-tool-call hooks
- MEDIUMGHSA-W9HF-3PP7-PVXV
OpenClaw: Exported session HTML could keep unsafe markdown links
- HIGHGHSA-WR9H-4R83-F4V6
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
- CRITICALGHSA-FCW5-X6J4-CCMP
Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
- MEDIUMGHSA-PMF8-G7C8-7V54
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr