Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Proof of Concept: CVE-2024-42008 and CVE-2024-42010 この概念実証（PoC）は、CSSインジェクションとクロスサイトスクリプティング（XSS）を可能にする、Roundcube Webmail の2つの脆弱性の悪用を実証します。攻撃は2つの段階で構成されます: 1. 悪意のあるXML添付ファイルによるXSS（CVE-2024-42008） ファイルアップロードのチェックが不十分なため、JavaScriptコードを含むXMLファイルを添付ファイルとして送信できます。例: " alertorigin...

CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC エクスプロイト alt text ExploitDB Dompdf バージョン 1.2.1 未満は、データに CSS を注入することでリモートコード実行（RCE）の脆弱性があります。Dompdf は、フォントキャッシュに .php ファイル拡張子を持つ悪意のあるフォントを保存するよう欺かれる可能性があり、そのファイルは後で Web からアクセスすることで実行される可能性があります。 使用方法 git clone https://github.com/rvizx/CVE-2022-28368 cd...

CVE-2026-1661

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-1661

The WP Mail Logging WordPress plugin, in versions prior to 1.17.0 , is vulnerable to HTML injection because it fails to properly restrict the HTML and CSS of logged emails before rendering them in admin log screens. This allows unauthenticated users to inject styled content and links—for instance...

PT-2026-104103

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-48849-Roundcube-Webmail-Stored-XSS

CVE-2026-48849 - Roundcube Webmail의 저장형 XSS, HTML 인젝션 및 CSS 인젝션 개요 이 저장소는 Roundcube Webmail에서 발견된 CVE-2026-48849 저장형 크로스 사이트 스크립팅XSS, HTML 인젝션 및 CSS 인젝션 취약점에 대한 개념 증명PoC을 포함합니다. 이 취약점은 이메일 제목 필드를 통해 주입된 공격자 제어의 HTML, CSS 및 JavaScript가 임시 저장/세션 복원 데이터 내에 저장되고, 사용자가 다시 로그인하여 세션을 복원할 때 자동으로 실행되도록 합니...

CVE-2026-85271

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271

Open edX Platform (versions from Redwood until Ulmo and Verawood.1) contains a stored CSS injection vulnerability in email digest notifications. The add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py fails to sanitize discussion-title value...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

EUVD-2026-83443

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

CVE-2026-85271 Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...

WP < 7.1.1 - Admin+ CSS Injection on Multisite via XML-RPC

Description WordPress does not properly enforce the capability required to edit custom CSS when publishing customizer changes through XML-RPC in some cases, which could allow site administrators on Multisite, who are denied that capability, to inject arbitrary CSS into the site...

Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the adjacent resize action still writes caller-controlled values directly into...

GHSA-FFMG-HFVG-JHG9 Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the adjacent resize action still writes caller-controlled values directly into...

CVE-2026-18119

Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script in an administrator's session and escalate privileges. The Concrete CMS...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could have injected CSS into stylesheets that are accessible via internal URIs, such as resource:, thereby bypassing a page’s Content Security Policy. This vulnerability affects Firefox ESR 91.11, Thunderbird 102, Thunderbird 91.11, and Firefox 101...

@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...

CVE-2026-86738

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...