CVE-2026-15371 | BDVDB-2026-360760 Detail

Description#

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-18Record published in the CVE List.
2. Version 22026-08-19Most recent update recorded in the CVE List.