PT-2026-139796
CVE-2026-123515
·
تاريخ النشر
2026-11-08
·
تاريخ التحديث
2026-11-08
الوصف من
CVSS 3.1
4.1
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾