How One Path Traversal in Grafana Unleashed XSS, Open Redirect and SSRF (CVE-2025–4123)

June 3, 2025

How One Path Traversal in Grafana Unleashed XSS, Open Redirect and SSRF (CVE-2025–4123)

Abusing Client Path Traversal to Chain XSS, SSRF and Open Redirect in GrafanaIntroductionA high-severity security vulnerability has been discovered in Grafana, identified as CVE-2025–4123, which combi …

Published Date:
Jun 03, 2025 (2 hours, 7 minutes ago)

Vulnerabilities has been mentioned in this article.

Source: Read More

Previous ArticleSplunk Enterprise XSS Vulnerability Let Attackers Execute Unauthorized JavaScript Code

Next Article Grafito: Visualizzatore di Log di Systemd con un’Interfaccia Web Accattivante

Highlights

CVE-2025-52560 – Kanboard Host Header Token Leak

June 24, 2025

CVE ID : CVE-2025-52560

Published : June 24, 2025, 3:15 a.m. | 2 hours, 1 minute ago

Description : Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46.

Severity: 8.1 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

In-House vs. Outsource Node.js Development Teams: 9 Key Differences for the C-Suite (2025)

Why Non-Native Content Designers Improve Global UX

DevOps won’t scale without platform engineering and here’s why your teams are still stuck

This week in AI dev tools: Slack’s enterprise search, Claude Code’s analytics dashboard, and more (July 18, 2025)

I ditched my Bluetooth speakers for this slick turntable – and it’s more practical than I thought

This split keyboard offers deep customization – if you’re willing to go all in

I spoke with an AI version of myself, thanks to Hume’s free tool – how to try it

I took a walk with Meta’s new Oakley smart glasses – they beat my Ray-Bans in every way

The details of TC39’s last meeting

The details of TC39’s last meeting

Simple wrapper for Chrome’s built-in local LLM (Gemini Nano)

Online Examination System using PHP and MySQL

Top 7 Computer Performance Test Tools Online (Free & Fast)

Top 7 Computer Performance Test Tools Online (Free & Fast)

10 Best Windows 11 Encryption Software

Google Chrome Is Testing Dynamic Country Detection for Region-Specific Features

How One Path Traversal in Grafana Unleashed XSS, Open Redirect and SSRF (CVE-2025–4123)

How One Path Traversal in Grafana Unleashed XSS, Open Redirect and SSRF (CVE-2025–4123)

Critical mcp-remote Vulnerability Enables Remote Code Execution, Impacting 437,000+ Downloads

CISA Adds Citrix NetScaler CVE-2025-5777 to KEV Catalog as Active Exploits Target Enterprises

Bayesian Belief Networks: Tools, Use Cases & Beginner Guide 2025

CVE-2025-23092 – Mitel OpenScape Accounting Path Traversal Vulnerability

Think Your IdP or CASB Covers Shadow IT? These 5 Risks Prove Otherwise

This AI Paper from Microsoft Introduces a DiskANN-Integrated System: A Cost-Effective and Low-Latency Vector Search Using Azure Cosmos DB

CVE-2025-52560 – Kanboard Host Header Token Leak

CVE-2025-41256 – Cyberduck and Mountain Duck TLS Certificate Pinning Weakness

CVE-2025-38085 – Linux Kernel: Huge Page Table Unshare Race Condition Vulnerability

CVE-2025-0921 – Mitsubishi Electric GENESIS64/MC Works64 Symbolic Link Privilege Escalation Vulnerability

How One Path Traversal in Grafana Unleashed XSS, Open Redirect and SSRF (CVE-2025–4123)

How One Path Traversal in Grafana Unleashed XSS, Open Redirect and SSRF (CVE-2025–4123)

Related Posts