Threats affecting pkg:github/milesmcc/shynet

CVE-2026-35508 is a medium severity vulnerability in milesmcc Shynet versions before 0.14.0. It allows cross-site scripting (XSS) attacks via the urldisplay and iconify template filters due to improper neutralization of input during web page generation. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. No known exploits are reported in the wild. No official patch or remediation details are provided in the available data.

Shynet versions before 0.14.0 have a vulnerability allowing Host header injection during the password reset process. This issue is classified under CWE-348, indicating the use of a less trusted source in security decisions. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium severity level. Exploitation requires network access, high attack complexity, no privileges, and user interaction. The impact includes low confidentiality, high integrity, and low availability impacts. No official patch or remediation details are currently provided by the vendor.