Most recent entries from all

certfr-2026-avi-1206 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

2026-10-10T17:15:17.507879+00:00

certfr-2026-avi-1206

fkie_cve-2025-9095

2026-10-10T17:15:17.507975+00:00

A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

GHSA-q4rg-7cjj-5r86 — ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js

2026-10-10T17:15:17.508039+00:00

Affected: npm: express-gateway

A cross-site scripting (XSS) issue exists in ExpressGateway up to 1.16.10 in the REST endpoint implemented in lib/rest/routes/users.js. User-controlled input is reflected into the HTTP response without proper sanitization, allowing arbitrary JavaScript execution in the browser of a logged-in user who views the affected page/route. The attack can be triggered over the network with low complexity and requires a low-privileged authenticated context and user interaction (viewing the page). Impact is limited to confidentiality and integrity of the session in the affected UI.