PT-2026-64995

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML...

Cross-site Scripting (XSS)

Overview trix is a Rich Text Editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the HTMLParser process. An attacker can inject malicious scripts by pasting crafted HTML containing a span element with an empty data-trix-attachment attribute, which bypasses...

CVE-2008-4066

CVE-2008-4066 affects Mozilla Firefox 2.0.0.x (e.g., 2.0.0.14 and earlier than 2.0.0.17). Description in connected advisories corroborates that HTML-escaped low surrogate characters could bypass XSS protections, enabling XSS. Affected component: Firefox HTML parser/rendering; root cause: HTML esc...

Mozilla low surrogates stripped from JavaScript before execution

Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "jav&56325ascript" sequence, a...