CVE-2026-102333

MediumCVSS 6.1/10Last modified Sep 30, 2026

Description

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing access to captured request and response data including headers and tokens.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1023347.4Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited pas CVE-2026-1023357.1Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permi CVE-2026-102343.5A vulnerability was detected in Mettle sendportal up to 3.0.1. This affects an unknown part of the file /webview/ of the component Campaign CVE-2026-1023425.4ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG anima CVE-2026-102356.3A flaw has been found in CodeAstro Ingredients Stock Management System 1.0. This vulnerability affects unknown code of the file /Ingredients CVE-2026-1023546.8BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DN CVE-2026-102367.3A vulnerability has been found in SourceCodester Water Billing Management System 1.0. This issue affects some unknown processing of the file CVE-2026-1023608.6A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticat CVE-2026-1023619.1mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers CVE-2026-1023625.3mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attack CVE-2026-1023633.7mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthentica CVE-2026-1023645.4mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office us