vulnerability

FreeBSD: VID-2eec1e85-faf3-11ea-8ac0-4437e6ad11c4 (CVE-2020-25787): tt-rss -- multiple vulnerabilities

Try Surface Command
Back to search
Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
Sep 20, 2020
Added
Dec 10, 2025
Modified
Dec 10, 2025

Description

tt-rss project reports: The cached_url feature mishandles JavaScript inside an SVG document. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error message. It does not validate all URLs before requesting them. Allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.

Solution

freebsd-upgrade-package-tt-rss

References

Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today