PT-2026-145471
CVE-2026-126814
·
تاريخ النشر
2026-11-11
·
تاريخ التحديث
2026-11-11
الوصف من
CVSS 3.1
3.5
منخفضةالمقاييسAV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾