640 matches found
EUVD-2026-114904
Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...
GHSA-79WV-8RH2-9VP2 AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the X-Forwarded-Prefix HTTP header. An attacker who can influence this header e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a...
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the X-Forwarded-Prefix HTTP header. An attacker who can influence this header e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a...
CVE-2026-117645 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...
CVE-2026-117645
The phoenix_html component of the phoenixframework is vulnerable to Cross-site Scripting (XSS) via attribute injection. The root cause is that attributes_escape/1 fails to validate or escape attribute names; specifically, key_escape/1 only neutralizes quotes and angle brackets but allows whitespa...
EEF-CVE-2026-117645 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Summary Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...
CVE-2026-117645 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...
CVE-2019-7219
CVE-2019-7219 CVE-2019-7219 Zarafa Webapp Author: verifysecurity At least Webapp version 1.6-46049 till 2.0.1.47791 are affected. hxxps://127.0.0.1/webapp/?fccc0"5f43d=1...
Cross-site Scripting (XSS)
Overview @highcharts/dashboards is a Highcharts Dashboards framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized attribute injection in the cell content input components CheckboxContent, DateInputContentBase, NumberInputContent, SelectContent,...
Cross-site Scripting (XSS)
Overview @highcharts/grid-pro is a Highcharts Grid Pro framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized attribute injection in the cell content input components CheckboxContent, DateInputContentBase, NumberInputContent, SelectContent,...
Ghidra Before 12.2 Numeric Truncation
Ghidra versions before 12.2 contain a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining that may allow crafted packed streams to inject attributes into decompiler input or crash the decompiler process...
CVE-2026-116012
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the...
EUVD-2026-109270
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the...
PT-2026-122593
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the...
CVE-2026-102786
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5...
EUVD-2026-109070
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5...
CVE-2026-102786
The Joomla Extension - phoca.cz (specifically Phoca Gallery ) versions 4.5.0 through 6.1.5 is vulnerable to an authenticated stored cross-site scripting (XSS) . The issue is caused by HTML attribute injection , allowing an attacker to execute malicious scripts in the context of other users' brows...
CVE-2026-102786 Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5...
CVE-2026-102786 Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5...