15255 matches found
CVE-2026-48953 Joomla! Core - [20260707] - XSS in the generic image output layout
Lack of escaping leads to an XSS vulnerability in the generic image output layout...
EUVD-2026-42062
Lack of escaping leads to an XSS vulnerability in the generic image output layout...
CVE-2026-48953
CVE-2026-48953 affects Joomla! Core. The issue is an XSS in the generic image output layout caused by a lack of escaping in the rendering path. Affected software is Joomla! Core (security entry notes this under 2026-07-07). The root cause is input/output escaping not being applied when generating...
CVE-2026-48953
Lack of escaping leads to an XSS vulnerability in the generic image output layout...
CVE-2026-48953 Joomla! Core - [20260707] - XSS in the generic image output layout
Lack of escaping leads to an XSS vulnerability in the generic image output layout...
GO-2026-5496 Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git
Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git...
GO-2026-5504 Hugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo
Hugo: Certain markdown links are not properly escaped in github.com/gohugoio/hugo...
PYSEC-2026-1937 Spotipy has a XSS vulnerability in its OAuth callback server
Summary XSS vulnerability in OAuth callback server allows JavaScript injection through unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. Details Vulnerable Code: spotipy/oauth2.py lines 1238-1274 RequestHandler.doGET The...
PYSEC-2026-1846 python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
Summary ldap.dn.escapednchars escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP...
PYSEC-2026-1686 nautobot has reflected Cross-site Scripting potential in all object list views
Impact It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting Reflected XSS attack against users. All filterable object-list views in Nautobot are...
PYSEC-2026-1102 aiohttp Cross-site Scripting vulnerability on index pages for static file handling
Summary A XSS vulnerability exists on index pages for static file handling. Details When using web.static..., showindex=True, the resulting index pages do not escape file names. If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks...
PT-2026-56224
Name of the Vulnerable Software and Affected Versions Joomla! Core affected versions not specified Description Lack of escaping in modalreturn layouts of various components allows for Cross-Site Scripting XSS, a technique where malicious scripts are injected into trusted websites. Recommendations...
PT-2026-56223
Name of the Vulnerable Software and Affected Versions Joomla! Core affected versions not specified Description Lack of escaping in the file management view of the com templates component leads to a Cross-Site Scripting XSS issue. XSS is a flaw that allows an attacker to inject malicious scripts...
PT-2026-56225
Name of the Vulnerable Software and Affected Versions Joomla! Core affected versions not specified Description Lack of escaping in the update list view of the com installer component leads to a Cross-Site Scripting XSS issue. XSS is a flaw that allows an attacker to inject malicious scripts into...
PT-2026-56226
Name of the Vulnerable Software and Affected Versions Joomla! Core affected versions not specified Description Lack of escaping in the generic image output layout leads to a Cross-Site Scripting XSS issue, where malicious scripts can be injected into web pages viewed by other users. Recommendatio...
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...
CVE-2026-11766
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, includin...
CVE-2026-11855
CVE-2026-11855 affects the Simple Membership WordPress plugin prior to 4.7.5. The issue arises because Stripe webhook requests are not authenticated when no signing secret is configured, and a value taken from those requests is not escaped before being output in an administrator notice. This lead...
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...