CVE-2026-102333— httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL
Quick assessment
Affected
cle-b httpdbg
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 httpdbg 2.2.1 之前的版本中，网页界面将记录的 HTTP 请求 URL 渲染为可点击链接时，未对这些 URL 的协议方案（URL schemes）进行验证。攻击者若能控制 httpdbg 所记录的流量，可注入使用 javascript: 协议的 URL。当用户点击这些链接时，会在应用原始上下文中执行恶意脚本，从而导致攻击者能够访问包括请求头、响应数据以及认证令牌在内的已捕获数据。
Possible ATT&CK Techniques 3 AI
T1005 · Data from Local System T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102333
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL
Source: CVE Program / CVE List V5
Vulnerability Description
httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing access to captured request and response data including headers and tokens.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-102333
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102333
请登录查看更多情报信息。
Other References for CVE-2026-102333 (8)
-
https://github.com/cle-b/httpdbg/blob/v2.2.0/httpdbg/webapp/static/index.htm#L302 technical-description
-
https://github.com/cle-b/httpdbg/blob/v2.2.0/httpdbg/hooks/recordhttp2.py#L88-L97 technical-description
-
https://github.com/cle-b/httpdbg product
-
https://github.com/cle-b/httpdbg/issues/220 issue-tracking
-
-
https://github.com/cle-b/httpdbg/releases/tag/v2.2.1 release-notes
IV. Related Vulnerabilities
Same weakness: CWE-79
-
CVE-2026-101141
Eleveo Call Recording Software Play Audio audio.jsp cross si -
CVE-2026-101111
Joomla Extension - ordasoft.com - Reflected Cross-Site Scrip -
CVE-2026-101109
Joomla Extension - ordasoft.com - Reflected Cross-Site Scrip -
CVE-2026-100753
Joomla Extension - ordasoft.com - Reflected Cross-Site Scrip -
CVE-2026-88804
Unauthenticated update of public UI settings leading to stor
V. Comments for CVE-2026-102333
No comments yet