CVE-2019-11581

CVE-2019-11581 Atlassian JIRA Template injection vulnerability RCE Demo python CVE-2019-11581.py http://xx.xx.xx.xx:8080/ "Command" Vuln Version Download https://product-downloads.atlassian.com/software/jira/downloads/atlassian-jira-software-7.13.0-x64.exe Poc...

CVE-2026-32635-Angular-XSS-Mitigation-

CVE-2026-32635: Angular i18n Attribute XSS - Mitigation & Detection PoC 📌 Overview This repository contains an educational demonstration of the mitigation and detection for CVE-2026-32635 , a Cross-Site Scripting XSS vulnerability in Angular that affects internationalized i18n attributes...

CVE-2026-118257

A flaw was found in vue-i18n. The HTML sanitization mechanism fails to properly neutralize inline frame iframe srcdoc attributes when processing translated content. A remote attacker could exploit this vulnerability by injecting malicious parameters or translation data into applications configure...

CVE-2026-118256

A flaw was found in vue-i18n. When parameter escaping is enabled, the library fails to properly sanitize named interpolation values if a translation call contains both list and named parameters. A remote attacker could exploit this vulnerability by supplying untrusted input to an application that...

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Summary When escapeParameter is enabled escapeParameterHtml in the Legacy API, Vue I18n escapes the interpolation parameters before formatting a message. escapeParams escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes...

GHSA-8RC2-428Q-7WW3 Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Summary When escapeParameter is enabled escapeParameterHtml in the Legacy API, Vue I18n escapes the interpolation parameters before formatting a message. escapeParams escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes...

npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

npm: Vue I18n: escapeParameter does not escape named values when the same call also passes a list vulnerability discovered by ? in WordPress npm vue-i18n versions = 9.0.0-beta.5, 11.4.14...

npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

npm: Vue I18n: escapeParameter does not escape named values when the same call also passes a list vulnerability discovered by ? in WordPress npm petite-vue-i18n versions = 9.2.0-alpha.7, 11.4.14...

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Summary When escapeParameter is enabled escapeParameterHtml in the Legacy API, Vue I18n passes the translated string through sanitizeTranslatedHtml. The sanitizer escapes in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of...

GHSA-83RM-6C8R-G728 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Summary When escapeParameter is enabled escapeParameterHtml in the Legacy API, Vue I18n passes the translated string through sanitizeTranslatedHtml. The sanitizer escapes in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of...

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages vulnerability discovered by ? in WordPress npm petite-vue-i18n versions 9.14.5...

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages vulnerability discovered by ? in WordPress npm vue-i18n versions 9.14.5...

CVE-2026-118257

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

CVE-2026-118256

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because...

EUVD-2026-112359

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

CVE-2026-118257

The Vue I18n internationalization plugin for Vue.js is vulnerable to Cross-Site Scripting (XSS) in versions 11.1.10 through 11.4.14, 12.0.0-alpha.4 through 12.0.0-alpha.5, and legacy versions 9.14.5 and 10.0.8. The root cause is that the sanitizeTranslatedHtml() function escapes markup within an ...

CVE-2026-118257 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

CVE-2026-118257 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

CVE-2026-118257 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

CVE-2026-118257

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...