CVE-2025-30349

Horde IMP の脆弱性 – HTML エンコーディングによる難読化 – XSS ペイロード Horde 5.2.23; IMP 6.2.27 脆弱性の詳細は Details.md ファイルで説明されています。 PoC は、脆弱性を悪用するペイロードを含むメールを作成し、受信者に送信します。この種のメールは、Horde Web クライアントで表示する必要があります（デスクトップクライアントなどの他のクライアントでは表示できません）。...

CVE-2025-44136

CVE-2025-44136 MapTiler Tileserver-php v2.0における認証不要のXSS 説明 MapTiler Tileserver-php v2.0はクロスサイトスクリプティング（XSS）に対して脆弱です。GETパラメータ「layer」がHTMLエンコードされずにエラーメッセージに反映されます。これによりXSSが発生し、認証されていない攻撃者が被害者のブラウザ上で任意のHTMLまたはJavaScriptコードを実行できるようになります。...

CVE-2026-47877

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

CVE-2026-33331

CVE-2026-33331 — oRPC OpenAPI 参考插件中的存储型 XSS orpc 的 OpenAPI 文档生成中存储型 XSS 的概念验证实验室 目的 oRPC 根据 OpenAPI 规范构建 API 文档页面。在 v1.13.9 之前，它使用 JSON.stringify 将规范直接转储到 标签中，且不进行任何 HTML 编码。攻击者控制的任何字段（如 info.description）都可以提前关闭该标签并运行脚本。...

CVE-2026-47877

Spring Security Authorization Server is vulnerable to Cross-Site Scripting (XSS) in its default consent page, which renders user-controlled values without HTML entity encoding. The flaw allows an attacker to inject scripts via crafted input reflected on the consent page, requiring user interactio...

CVE-2026-47877 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

EUVD-2026-66773

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-50980

CVE-2026-50980: DNS-basierte Cross-Site-Scripting XSS & Session Hijacking in oPanel Übersicht CVE-ID: CVE-2026-50980 Produkt: oPanel Betroffene Versionen: v1.20.25 Schwachstellentyp: Stored Cross-Site-Scripting XSS über DNS / Session Hijacking Schweregrad: Hoch...

CVE-2026-76837 Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the firstname value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name...

EUVD-2026-60956

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-66807

A flaw was found in console. The getCodeSpan helper in SharedResourceWarning.js constructs an HTML string using string concatenation without proper HTML encoding. This unescaped string is then rendered via React's dangerouslySetInnerHTML. While current Kubernetes DNS-1123 name validation prevents...

CVE-2026-73628

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

CVE-2026-73628

The CVE-2026-73628 entry concerns Serendipity versions 2.3.5 through 2.6.0, which contain a reflected XSS in the search clean-URL route (/search/). In include/functions_routing.inc.php, the serveSearch() sanitisation sequence applies urldecode() after HTML-encoding, allowing a URL-encoded HTML pa...

PT-2026-71456

Serendipity versions = 2.3.5 and . In include/functions routing.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives strip tags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search li...

CVE-2026-73492

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

UBUNTU-CVE-2026-73492

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

DEBIAN-CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73492 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-72787

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...