1394 matches found
CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...
CVE-2026-66829
The CVE affects html_sanitize_ex (HtmlSanitizeEx.html5/1) where attacker-supplied meta refresh elements survive sanitization. The root cause is that a meta element can apply document-wide directives, enabling open redirects to user-chosen sites via a tag. Affected versions: html_sanitize_ex from...
EUVD-2026-54082
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...
CVE-2026-66370 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction...
CVE-2026-66843
CVE-2026-66843 affects html_sanitize_ex HTML5 scrubber. The vulnerability arises because the object element (data attribute) is not registered in allow_tag_with_uri_attributes/3, and the only guard is a lowercase javascript: prefix. This allows attacker-supplied content to be embedded in a truste...
EUVD-2026-54080
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...
CVE-2026-66843
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...
EEF-CVE-2026-66843 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
Summary Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing...
CVE-2026-66843: Inclusion of Functionality from Untrusted Control Sphere
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...
CVE-2026-66370: URL Redirection to Untrusted Site
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction...
CVE-2026-66829: URL Redirection to Untrusted Site
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...
PT-2026-68623
Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An Open Redirect issue exists in the HTML5 scrubber of the software. A remote attacker can force visitors to navigate to an untrusted site by inserting a element into sanitized HTML. Th...
PT-2026-68624
Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An Inclusion of Functionality from Untrusted Control Sphere issue exists in the HTML5 scrubber. A remote attacker can load an arbitrary document into a trusted page by utilizing the dat...
WordPress HTML5 Video Player plugin <= 5.3.4.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin HTML5 Video Player versions = 5.3.4.0...
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Summary Loofah::HTML5::Scrub.alloweduri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references tab or line feed. This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references , , but...
CVE-2024-23578
HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing CORS policy for this request that allows access from any domain -Wildcard...
CVE-2024-23578
HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing CORS policy for this request that allows access from any domain -Wildcard...
CVE-2024-23578
CVE-2024-23578 affects HCL Aftermarket EPC. The issue stems from an HTML5 CORS policy that allows access from any origin, enabling cross-origin requests to the app’s endpoints. CVSSv3.1 metrics show a base score of 4.2 (Medium): Network, High attack complexity, No privileges required, User intera...
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Summary Loofah::HTML5::Scrub.alloweduri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references tab or line feed. This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references , , but...
