48 matches found
GHSA-39Q2-94RC-95CP DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
Summary In src/purify.ts:1117-1123, ADDTAGS as a function via EXTRAELEMENTHANDLING.tagCheck bypasses FORBIDTAGS due to short-circuit evaluation. The condition: !tagChecktagName && !ALLOWEDTAGStagName || FORBIDTAGStagName When tagChecktagName returns true, the entire condition is false and the...
Operator Precedence Logic Error
Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Operator Precedence Logic Error in the form of short-circuit evaluation that gives precedence to ADDTAGS over FORBIDTAGS in sanitizeElements. In an...
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
Summary In src/purify.ts:1117-1123, ADDTAGS as a function via EXTRAELEMENTHANDLING.tagCheck bypasses FORBIDTAGS due to short-circuit evaluation. The condition: !tagChecktagName && !ALLOWEDTAGStagName || FORBIDTAGStagName When tagChecktagName returns true, the entire condition is false and the...
PT-2026-63989
Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.0 Description A logic error exists in the ADD TAGS function where short-circuit evaluation allows tags listed in FORBID TAGS to bypass restrictions. This occurs when tags are simultaneously listed in both FORBID...
EUVD-2018-9704
Malware in sbrugna...
EUVD-2023-37522
Malicious code in bioql PyPI...
CVE-2025-9823 Reflected XSS in lead:addLeadTags - Quick Add
SummaryA Cross-Site Scripting XSS vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or escaping, potentially enabling malicious...
CVE-2023-26982
Trudesk v1.2.6 was discovered to contain a stored cross-site scripting XSS vulnerability via the Add Tags parameter under the Create Ticket function...
CVE-2023-33359
Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...
Cross site request forgery (csrf)
Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...
CVE-2023-33359
Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...
CVE-2023-33359
Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...
CVE-2023-33359
Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...
Piwigo 跨站请求伪造漏洞
Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A security vulnerability exists in Piwigo version 13.6.0, which stems from a problem with the Add Tags feature and can be exploited by...
CVE-2023-26982
Trudesk v1.2.6 was discovered to contain a stored cross-site scripting XSS vulnerability via the Add Tags parameter under the Create Ticket function...
CVE-2023-26982
CVE-2023-26982 concerns Trudesk v1.2.6, which contains a stored cross-site scripting (XSS) vulnerability in the Create Ticket function, exploitable via the Add Tags parameter. Root cause: unsanitized input in Add Tags leads to script execution within affected user sessions. Impact: can enable mal...
CVE-2023-26982
Trudesk v1.2.6 was discovered to contain a stored cross-site scripting XSS vulnerability via the Add Tags parameter under the Create Ticket function...
PT-2023-20887 · Trudesk · Trudesk
Name of the Vulnerable Software and Affected Versions: Trudesk version 1.2.6 Description: The issue is a stored cross-site scripting XSS vulnerability. It occurs via the Add Tags parameter under the Create Ticket function. This allows for potential malicious script execution when a user interacts...