CVE-2026-59802 — PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push Payload
PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes contain…
Published: 2026-07-08 · CVSS: 6.3 · CVSS 4.0
PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7