2 matches found
CVE-2026-35451: Improper Neutralization of Input During Web Page Generation
Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting XSS vulnerability exists in the BlockNote editor component. Due to a lack of protocol validation in the FileBlock component and insufficient server-side inspection of block content, an attacker can inject a javascript: U...
5.7CVSS6AI score0.00421EPSS
SaveExploits0References2
PT-2026-34007
Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting XSS vulnerability exists in the BlockNote editor component. Due to a lack of protocol validation in the FileBlock component and insufficient server-side inspection of block content, an attacker can inject a javascript: U...
5.7CVSS6.1AI score0.00421EPSS
SaveExploits0References3
20