621 matches found
CVE-2023-36471
Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishi...
CVE-2023-38500
TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious...
CVE-2022-36020
The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package masterminds/html5, malicious markup used in a sequence with special HTML comments cannot...
CVE-2022-34473
The HTML Sanitizer should have sanitized the href attribute of SVG tags; however it incorrectly did not sanitize xlink:href attributes. This vulnerability affects Firefox 102...
CVE-2021-23974
The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...
CVE-2011-4457
OWASP HTML Sanitizer aka owasp-java-html-sanitizer before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element...
CVE-2019-19619
domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS...
CVE-2019-10062
The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via for example JavaScript code in an...
ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 on GA media (moderate)
ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 on GA media Announcement ID: openSUSE-SU-2025:15125-1 Rating: moderate Cross-References: CVE-2015-7578 CVE-2015-7579 CVE-2015-7580 CVE-2018-3741 CVE-2022-23517 CVE-2022-23518 CVE-2022-23519 CVE-2022-23520 CVE-2022-32209 CVSS scores: CVE-2018-3741 SUS...
The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications allows attackers to perform cross-site scripting attacks.
The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications is related to improper elimination of input data during web page generation. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications allows attackers to perform cross-site scripting attacks.
The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications is related to improper elimination of input data during web page generation. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications allows attackers to perform cross-site scripting attacks.
The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications is related to improper elimination of input data during web page generation. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications allows attackers to perform cross-site scripting attacks.
The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications is related to improper elimination of input data during web page generation. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications allows attackers to perform cross-site scripting attacks.
The vulnerability of the Rails Html Sanitizer configuration tool for cleaning HTML applications is related to improper elimination of input data during web page generation. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
ROS-20250402-05
A vulnerability in the configuration implementation of the HTML cleanup tool for Rails Html Sanitizer applications is related to with insufficient cleaning of user-supplied data. Exploitation of the vulnerability could allow An attacker acting remotely could conduct cross-site scripting attacks...
JS Html Sanitizer allows XSS when used with contentEditable
Impact XSS vulnerability when the sanitizer is used with a contentEditable element to set the elements innerHTML to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. Patches Patched in version 2.0.3...
CVE-2025-29771
HtmlSanitizer (client-side HTML sanitizer) is affected: versions prior to 2.0.3 are vulnerable to cross-site scripting when used with a contentEditable element that sets innerHTML to a sanitized string. The issue is caused by the code beautifier running after sanitation, enabling XSS. remediation...
Linux Distros Unpatched Vulnerability : CVE-2023-23627
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is...
CVE-2025-24028 Cross-site Scripting (XSS) in Rich Text Editor allows arbitrary code execution in Joplin
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Tex...
CVE-2025-24028
The CVE-2025-24028 entry describes an XSS in Joplin affecting the Rich Text Editor and the Markdown viewer due to how Joplin’s HTML sanitizer handles comments versus how browsers treat them. The Markdown viewer is cross-origin isolated, so exploits cannot access the top-level window. The issue is...