CVE-2024-37888 – CKEditor 4 Open Link plugin XSS

Demonstrates turning self-XSS into real attacks, such as payloads that fire when admins view a user's profile, and suggests logging callbacks to prove impact when reporting these findings.

Overview

A deep dive into JavaScript prototype pollution: how attackers control undeclared variables to turn weakly-typed checks into XSS on the client side or remote code execution on the server side.

According to Gartner, 75% of the attacks are coming though web applications and not through the network. This means greater emphasis needs to be placed on application security. However, this does not appear to be happening.

A researcher demonstrates how a single comma in the Content-Type header creates a parser differential between browsers and MIME parsing libraries, letting attackers bypass validation and achieve reflected XSS.

NetSPI reports CVE-2026-78902, a stored cross-site scripting issue in the pfSense pfBlockerNG package that can be escalated to remote code execution with a single DNS request.