CVE-2026-59802

Name of the Vulnerable Software and Affected Versions PasswordPusher versions prior to 2.8.1

Description Insufficient validation in the valid url() function allows the application to accept data URI schemes in URL push payloads. This enables attackers to create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in the browsers of users who click the link, facilitating phishing and credential theft under the trusted domain.

Recommendations Update to version 2.8.1 or later.