CVE-2026-71802

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

EUVD-2026-75161

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

CVE-2026-71802

A stored XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3 . Although announcement content is HTML-escaped on the server side, client-side preview code reverses the escaped entities using jQuery's html().text() method and injects the result into the DOM. An administr...

Announcement Preview banner is a vector for an XSS attack

The announcement preview banner is currently displayed via the global decorator. It can be used for an XSS attack on virtually every page, via the announcementpreviewbannerst URL parameter. We should display the preview only locally in the admin section...

Announcement Preview banner is a vector for an XSS attack

The announcement preview banner is currently displayed via the global decorator. It can be used for an XSS attack on virtually every page, via the announcementpreviewbannerst URL parameter. We should display the preview only locally in the admin section...