19979 matches found
PT-2026-121743
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table /log and in element history tables. Every branch of LogEntryExtraFormatter::getInternalFormat runs...
PT-2026-121746
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlled Part names. A user who can edit a...
PT-2026-121763
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages...
Swagger-HTML-Injection-CVE-2025-8191
https://example.com/swagger/swagger.html?configURL=https://raw.githubusercontent.com/mayank-s16/Swagger-HTML-Injection-CVE-2025-8191/refs/heads/main/test.json...
CVE-2026-115507
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...
CVE-2026-115507 Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...
EUVD-2026-108339
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...
CVE-2026-115507
Vikunja versions 2.2.0 before 2.7.1 are vulnerable to an HTML injection flaw within the CreateConversationalHeader function in pkg/notifications/mail.go. The vulnerability occurs because the application interpolates display names, task titles, and project titles raw into email anchors. An authent...
CVE-2026-113787
The odf-kit library, which handles OpenDocument Format files in TypeScript and JavaScript, is vulnerable to HTML injection leading to Cross-site Scripting (XSS) in versions 0.10.0 through 0.14.1 . The root cause is that the renderer fails to escape inline CSS strings in the odtToHtml() function. ...
CVE-2026-113787 odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src,...
CVE-2026-113787 odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src,...
CVE-2026-14556
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...
CVE-2026-14556 HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...
CVE-2026-14556
The HappyForms WordPress plugin (versions before 1.26.15 ) is vulnerable to unauthenticated HTML injection . The root cause is the failure to sanitize or escape a user-controlled referral value (client_referer) before embedding it into form notification emails. This allows unauthenticated attacke...
CVE-2026-14556 HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...
EUVD-2026-107147
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...
WordPress HappyForms plugin < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email vulnerability
Unauthenticated HTML Injection in Admin Notification Email vulnerability discovered by minaruzzaman shovon in WordPress Plugin Happyforms versions 1.26.15...
Linux Distros Unpatched Vulnerability : CVE-2026-109597
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted...
PT-2026-120505
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...