CVE-2026-41308: falha de média gravidade em pglombardo PasswordPusher
Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
pglombardo · PasswordPusherCVEs relacionadas — pglombardo PasswordPusher
No mesmo produto, das mais perigosas para as menos.
CVE-2026-62382MEDIUMPasswordPusher before v2.9.6 Authentication Bypass via Null ComparisonEPSS 1.2%CVE-2024-52796MEDIUMPassword Pusher's rate limiter can be bypassed by forging proxy headersEPSS 0.5%CVE-2026-61458HIGHPasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled EndpointEPSS 0.4%CVE-2026-87816HIGHPasswordPusher before 2.11.1 Race Condition View Limit BypassEPSS 0.4%CVE-2024-51989HIGHCross-site Scripting (XSS) Vulnerability in PasswordPusherEPSS 0.4%CVE-2024-56733MEDIUMPassword Pusher Allows Session Token Interception Leading to Potential HijackingEPSS 0.2%