Funfactor1

**Name of the Vulnerable Software and Affected Versions** wallabag versions 2 through 2.6.14 **Description** Server-Side Request Forgery (SSRF) occurs during the PDF export process when the application mishandles a crafted title or content field. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** Update wallabag to a version later than 2.6.14.

**Name of the Vulnerable Software and Affected Versions** Pocket versions prior to 8.33.0.0 **Description** The application is susceptible to Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites. This occurs because the "Save to Pocket" feature injects external HTML directly into the Document Object Model (DOM), which is the programming interface for HTML and XML documents. Consequently, JavaScript code can be used to modify the application state by utilizing native bridge methods. **Recommendations** Update to a version newer than 8.33.0.0.