CVE-2026-59802 | BDVDB-2026-346358 Detail

Description#

PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-08Record published in the CVE List.
2. Version 22026-07-14Most recent update recorded in the CVE List.