98 matches found
CVE-2026-81852
Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...
EUVD-2026-68328
Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...
CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...
CVE-2026-81852
AshAdmin (ash-project/ash_admin), an Elixir/Phoenix library, shipped a hardcoded CSP nonce (ash_admin-Ed55GFnX) as a compile-time constant when mounted without the :csp_nonce_assign_key option. This value was written verbatim into inline and [removed] tags on every response and was never rotated...
CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
Use of Insufficiently Random Values vulnerability in ash-project ashadmin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :cspnonceassignkey, AshAdmin.Router.ashadmin/2 defaulted the img, style, and script nonces to the...
CVE-2026-71503
Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...
EUVD-2026-65075
Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...
CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template
Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...
CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template
Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...
CVE-2026-71503
Dolibarr before 24.0.0 is affected by a reflected cross-site scripting (XSS) vulnerability in the extra fields administration template . The type request parameter is reflected without JavaScript-context encoding into an inline [removed] block, and no Content-Security-Policy header is emitted. An...
CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template
Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...
CVE-2026-17013
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...
EUVD-2026-57092
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...
CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...
CVE-2026-17013
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...
CVE-2026-17013
The vulnerability affects the WP Photo Album Plus WordPress plugin prior to version 9.2.07.002. The issue is that a parameter is not properly sanitised/escaped before being reflected into an inline script block, enabling unauthenticated attackers to perform Reflected Cross-Site Scripting against ...
CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...
PT-2026-71017
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...
CVE-2026-73084
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...
CVE-2026-15047
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...