108650 matches found
CVE-2024-42009
CVE-2024-42009 – XSS Almacenado en Roundcube PoC Docker 📌 Descripción General Este repositorio demuestra una Prueba de Concepto PoC funcional para CVE-2024-42009 , una vulnerabilidad de Cross-Site Scripting XSS almacenado en Roundcube Webmail. La vulnerabilidad es causada por una sanitización HTM...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
CVE-2026-73858
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...
CVE-2026-59167
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an applicati...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
CVE-2026-59167
The SunEditor WYSIWYG editor is vulnerable to a critical XSS vulnerability in versions <= 2.47.10 (specifically confirmed in v2.47.10). The root cause is a sanitizer bypass in src/lib/core.js where the logic fails to consistently reject namespaced or custom HTML elements (e.g., ). This allows ...
CVE-2026-81338
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...
EUVD-2026-85028
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Subscriber+ Stored HTML Injection vulnerability
Subscriber+ Stored HTML Injection vulnerability discovered by Jaime F. Murillo in WordPress Plugin MasterStudy LMS versions 3.7.50...
CVE-2026-81338
The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) is vulnerable to stored HTML injection due to insufficient sanitization and restriction of HTML in user-submitted content. This flaw allows users with subscriber-level accounts and above to inject malicious content, such as iframes , ...
CVE-2026-81338 MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
EUVD-2026-84953
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...
Linux Distros Unpatched Vulnerability : CVE-2026-92018
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3,...
The vulnerability of the HTML-in-Canvas component in Google Chrome and Microsoft Edge web browsers allows a hacker to gain unauthorized access to protected information.
The vulnerability of the HTML-in-Canvas component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
Linux Distros Unpatched Vulnerability : CVE-2026-92028
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3,...
Linux Distros Unpatched Vulnerability : CVE-2026-93981
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an...
ALSA-2026:70640 Important: buildah security update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...