PasswordPusher vulnerabilities
Published CVEs affecting PasswordPusher products: 1 record(s), with severity, exploitation and fixes.
CVE-2026-59802
High · 8.2
CWE-183 Jul 8, 2026
PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push Payload
PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malicious pushes containing data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.