HTMLawed

HTMLawed とは ... ... 入力テキストをより安全にし、HTML 標準に準拠させ、ウェブページ管理者の観点から一般的に HTML、XHTML、または XML ドキュメントの本文での使用に適したものにする、単一ファイルの 45 kb の PHP スクリプトです。HTMLTidy のシンプルな代替である htmLawed フィルタ、プロセッサ、ピュリファイア、サニタイザ、ビューティファイアなどは、高度にカスタマイズ可能です。 HTML タグがバランスよく、適切にネストされることを保証し、クロスサイトスクリプティング XSS 攻撃に悪用される可能性のあるコードを無効化し、許可される...

java-html-sanitizer

OWASP Java HTML Sanitizer 高速で設定が簡単なHTMLサニタイザー。Javaで書かれており、Webアプリケーションに第三者によって作成されたHTMLを含めることを可能にし、XSSから保護します。 既存の依存関係はJSR 305です。他のjarはテストスイートにのみ必要です。JSR 305依存関係はコンパイル時のみの依存関係であり、アノテーションにのみ必要です。 このコードはセキュリティのベストプラクティスを考慮して書かれており、広範なテストスイートを持ち、敵対的セキュリティレビューを受けています。 目次 はじめに 組み込みポリシー ポリシーの作成 カスタムポリシー...

bluemonday

bluemonday bluemonday は Go で実装された HTML サニタイザーです。高速で、高度に設定可能です。 bluemonday は、信頼できないユーザー生成コンテンツを入力として受け取り、承認された HTML 要素と属性の許可リストに基づいてサニタイズされた HTML を返すため、そのコンテンツを Web ページに安全に含めることができます。 ユーザー生成コンテンツを受け入れており、サーバーが Go を使用しているなら、bluemonday が必要です 。 ユーザー生成コンテンツのデフォルトポリシー（bluemonday.UGCPolicy.Sanitize）は、これ...

OWASPBugBounty

OWASP Bug Bounty for Projects はじめに セキュリティを導入しようと考えている多くの開発者や企業は、重要なアプリケーションを保護するために実装できるDefenderライブラリを利用しようと、OWASPに注目しています。これはOWASPに対する信頼の一形態を意味するため、これらのプロジェクトの利用者の多くは、それらの多くがオープンソースであり、現時点でOWASPによって実施されていないセキュリティ保証レビューが欠けていることを忘れたり、認識していなかったりする可能性があります。 リポジトリ...

bleach

Bleach 참고: 2026-06-05: Bleach는 더 이상 유지보수되지 않습니다. 보안 문제를 포함한 향후 릴리스는 없습니다. 관련 이슈: Bleach는 허용 목록 기반 HTML 정화 라이브러리로, 마크업과 속성을 이스케이프 또는 제거합니다. Bleach는 또한 Django의 urlize 필터가 할 수 없는 필터를 적용하여 텍스트를 안전하게 링크화할 수 있으며, 이미 텍스트에 있는 링크에도 선택적으로 rel 속성을 설정할 수 있습니다. Bleach는 신뢰할 수 없는 출처의 텍스트를 정화하기 위해 설계되었습니다. 사이트...

CVE-2026-55230

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content...

CVE-2026-55230

The Vvveb CMS (prior to version 1.0.8.6 ) contains a Stored XSS vulnerability due to a flaw in the sanitizeHTML() filter. The HTML sanitizer fails to strip event-handler attributes when a tag contains a greater-than character inside a quoted attribute value. A low-privilege content author (such a...

Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_8506)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228506 advisory. netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37136 netty-codec: SnappyFrameDecoder doesn't restrict chu...

sanitize

Sanitize Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML and/or CSS from a string except the elements, attributes, and properties you choose to allow. Using a simple configuration syntax, you can tell Sanitize to allow certain HTML elements, certain attributes within...

TYPO3-HTML-Sanitizer-XSS-CVE-2023-47125

TYPO3 HTML Sanitizer における保存型XSS（エクスプロイト）（CVE-2023-47125） 説明 DOM処理命令が正しく処理されません。これにより、typo3/html-sanitizer のクロスサイトスクリプティングメカニズムをバイパスすることが可能になります。 影響を受けるバージョン = 1.0.0, = 2.0.0,...

CVE-2026-63206

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-63006 Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-63006 Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-63006 Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-63206

The Zammad open source helpdesk system is vulnerable to a remote image tracking bypass in versions prior to 7.1.2 . The root cause is a flaw in the HTML sanitizer , which fails to recognize shortened URL formats that omit the double slash after the scheme (e.g., http:) as remote content. While th...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

EUVD-2026-87258

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-59167

The SunEditor WYSIWYG editor is vulnerable to a critical XSS vulnerability in versions <= 2.47.10 (specifically confirmed in v2.47.10). The root cause is a sanitizer bypass in src/lib/core.js where the logic fails to consistently reject namespaced or custom HTML elements (e.g., ). This allows ...