Stefanprodan vulnerabilities
2 vulnerabilities
Known vulnerabilities in Stefanprodan products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Podinfo2 vulnerabilities
RoutineCVE-2026-43644stefanprodan · podinfo +1 morepodinfo 6.11.2 Reflected XSS via /echo Endpointpodinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page.CVSS6.1MediumEPSS0.19%RoutineCVE-2025-70849stefanprodan · podinfo +1 morestefanprodan podinfoArbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).CVSS6.1MediumEPSS0.28%