Vendor
unclecode
23 known vulnerabilities.
Products
8 results · Clear filters · Feed
-
Medium 4.3
Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for
Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. Attackers can inject …
-
Medium 5.3
Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to fo…
-
Medium 6.5
Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forge…
-
Medium 6.5
Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-…
-
Medium 5.3
Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo
Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=tr…
-
Medium 5.3
Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch
Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress controls. Attackers can enable check_robots_txt and use redirects or DNS rebinding to re…
-
Medium 6.1
crawl4ai before 0.9.3 DOM-based XSS via Playground UI
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scri…
-
Medium 5.4
crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Play…