8 matches found
CVE-2026-115507
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...
CVE-2026-115507 Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...
CVE-2026-115507
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...
CVE-2026-115507
Vikunja versions 2.2.0 before 2.7.1 are vulnerable to an HTML injection flaw within the CreateConversationalHeader function in pkg/notifications/mail.go. The vulnerability occurs because the application interpolates display names, task titles, and project titles raw into email anchors. An authent...
EUVD-2026-108339
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...
CVE-2026-115507 Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...
Vikunja cross-site scripting vulnerability
Versions 2.2.0 through 2.7.1 of Vikunja contain a cross-site scripting vulnerability. This flaw arises because the CreateConversationalHeader function in pkg/notifications/mail.go inserts the display name and task/project title verbatim into email anchor points. Authenticated users can craft titl...
PT-2026-121581
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...