EUVD-2026-105171

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization...

CVE-2026-112958

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...

CVE-2026-112958

The ApostropheCMS Node.js content management system is vulnerable to Stored XSS in versions prior to 4.34.0 . The root cause is a lack of HTML-attribute encoding within the wrapper serializer for project-defined free-form widget style fields. An editor can inject an unescaped quote into an inline...

CVE-2026-112958 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...

CVE-2026-112958 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...

CVE-2026-112958 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...

PT-2026-118490

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description A project-defined free-form widget style field allows an editor-controlled quote to be inserted into an inline style attribute because the wrapper serializer fails to apply HTML-attribute...

wget: Fix of 2 CVEs

CVE-2026-58470: fix integer overflow in Content-Range header parsing - CVE-2026-58472: fix integer/heap buffer overflow in HTML attribute entity encoding...

USN-8543-1: Wget vulnerabilities

It was discovered that Wget mishandled semicolons in the userinfo subcomponent of a URL. A remote attacker could possibly use this issue to trick a user into connecting to a different host than intended. This issue only affected Ubuntu 14.04 LTS. CVE-2024-38428 It was discovered that Wget...

PT-2026-56241

Name of the Vulnerable Software and Affected Versions GNU Wget versions prior to 1.25.0 commit dd692d9 Description A heap buffer overflow occurs in the html quote string function within src/convert.c. A remote attacker can trigger memory corruption by providing a crafted HTML attribute containing...

CVE-2026-39333

ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects user-supplied input DateStart and DateEnd into HTML input field attributes without proper output encoding for the HTML attribute context. An authenticated attacker can craft a malicious U...

CVE-2021-31739

The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability XSS, because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient address...

CVE-2021-31739

The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability XSS, because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient address...