CVE-2026-117493

Sisense's Cloud BI Platform is vulnerable to Stored Cross-Site Scripting (XSS) in BloX widgets . The /api/dashboards//widgets/ API fails to properly sanitize HTML and JavaScript content submitted via the desc and text parameters. When a widget is rendered, the injected code executes in the user's...

CVE-2026-117493 Multiple vulnerabilities in Sisense’s Cloud BI Platform

Stored cross-site scripting XSS in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information...

PT-2026-125901

Stored cross-site scripting XSS in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information...

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField. Patches The field must now explicitly configure SharpFormEditorField::RAWHTML in the toolbar to keep this behavior. When using the RAWHTML...

GHSA-VJ3Q-VP3G-J9C8 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField. Patches The field must now explicitly configure SharpFormEditorField::RAWHTML in the toolbar to keep this behavior. When using the RAWHTML...

EUVD-2026-86384

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the FormatsSanitizedValue sanitizer, which fails to restrict the srcdoc attribute on elements and incorrectly applies encoding bypass logic unconditionally when the RAWHTML toolbar button is present. An...

CVE-2026-61825

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...

CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...

CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...

CVE-2026-61825

The code16/sharp Laravel-based framework is vulnerable to stored cross-site scripting (XSS) in versions before 9.22.5 . The flaw exists within the SharpEditorFormField component, where attacker-controlled content using the data-html-content attribute can bypass HTML sanitization to preserve and e...

CVE-2026-61825

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in "SharpEditorFormField": attacker-controlled content bearing the "data-html-content" attribute can bypass HTML...

CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...

PT-2026-98243

Name of the Vulnerable Software and Affected Versions code16 Sharp versions prior to 9.22.5 Description A stored cross-site scripting issue exists in SharpEditorFormField. Attacker-controlled content using the data-html-content attribute can bypass HTML sanitization, allowing executable markup to...

CVE-2026-61825: Improper Neutralization of Input During Web Page Generation

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...

CVE-2026-19619: Improper Neutralization of Input During Web Page Generation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

CVE-2026-14307

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into...

CVE-2026-16627

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

CVE-2026-45572

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...

CVE-2026-45572 Decidim: HTML content blocks allow stored script execution

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...