CVE-2026-126451 OpenEMR before 8.5.0 Stored XSS via Document Template Rendering

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document templatedata. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by...

CVE-2026-126451

OpenEMR versions prior to 8.5.0 are vulnerable to a stored cross-site scripting (XSS) flaw during Document Template Rendering . The root cause is the DocumentTemplateRender function, which fails to sanitize an encounterForm value rendered into an iframe src. This allows portal patients to inject ...

CVE-2026-118660

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

David Ortner Happy DOM server-side request forgery vulnerability

David Ortner: Versions prior to Happy DOM 21.0.0 contain a server-side request forgery vulnerability. This vulnerability arises because, when parsing untrusted HTML on the server, the default behavior loads iframe src URLs and link rel="stylesheet" href URLs. This may lead to server-side request...

PT-2026-118339

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src...

Chatwoot Cross-Site Script Vulnerability

Versions of Chatwoot prior to 4.14.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from video embedding links in the Help Center article, where the iframe src attribute was not properly escaped. This could lead to a stored-xss attack, allowing account administrators t...

CVE-2026-111713

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

EUVD-2026-103005

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111713

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111713 tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111713 tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111713 tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111713

The library tarteaucitron.js before version 1.37.0 is vulnerable to cross-site scripting (XSS) due to an attribute validation mismatch. The getElemAttr function resolves attributes prefixed with data-, whereas the https-only guard only validates unprefixed attributes. This discrepancy allows atta...

CVE-2026-111713: Improper Neutralization of Input During Web Page Generation

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

PT-2026-116112

Name of the Vulnerable Software and Affected Versions tarteaucitron.js versions prior to 1.37.0 Description A cross-site scripting issue exists because the getElemAttr function resolves attributes prefixed with data-, whereas the https-only guard only validates the unprefixed version of the...

Amauri CHAMPEAUX tarteaucitron.js cross-site scripting vulnerabilities

Amauri CHAMPEAUX’ tarteaucitron.js version 1.20.1 to 1.37.0 had a cross-site scripting vulnerability. This vulnerability stemmed from the getElemAttr function parsing attributes with a “data-” prefix. However, the https-only protection mechanism only validated attributes without a prefix, leading...

PT-2026-104642

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.2.0 Description A stored cross-site scripting issue exists where users with upload permissions can inject scripts by providing a malicious URL for the video trailer. This value is rendered without proper escaping in...

BIT-DISCOURSE-2026-91123 Discourse: Reject literal backslash path separators in iframe src traversal guard

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowediframes subpath check while browser...

PT-2026-105080

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed iframes subpath check while browse...

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

Summary With $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Details The iframe...