Lucene search
+L

346 matches found

NVD
NVD
added 2026/09/16 10:17 p.m.7 views

CVE-2026-61597

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it...

5.1CVSS0.003EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/16 9:51 p.m.5 views

EUVD-2026-81300

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it...

5.1CVSS0.003EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/16 8:25 p.m.7 views

cve-2016-1764

PoC Exploit Code for CVE-2016-1764 Recovery of Plaintext iMessage Data Without Breaking Crypto Authors Shubham Shah from Bishop Fox Joe DeMesy from Bishop Fox Matthew Bryant CVE-2016-1764 Vendor: Apple Release Date: April 8, 2016 Patch Date: March 21, 2016 Systems Affected: Messages on OSX Mounta...

4.3CVSS6.9AI score0.02635EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/16 1:33 a.m.6 views

CVE-2026-73319

CVE-2026-73319: JavaScript URI accepted as a dynamic redirect XenForo before 2.3.13 accepts a same-host javascript: URI as a dynamic redirect and later assigns it to window.location. What happens Server-side redirect validation rejects foreign hosts but does not require HTTP or HTTPS. A URL shape...

6.1CVSS5.8AI score0.00286EPSS
SaveExploits2
NVD
NVD
added 2026/09/15 9:16 p.m.5 views

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

1.8CVSS0.00309EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/15 8:21 p.m.6 views

EUVD-2026-79945

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

1.8CVSS5.7AI score0.00309EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/15 3:35 p.m.5 views

CVE-2026-55630 Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)

Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extralink and TestPlan.extralink accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a...

5.4AI score
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/10 7:29 p.m.11 views

RealPlayer_G2_RCE

Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Remote Code Execution Vulnerability Video demo: https://www.youtube.com/watch?v=9c9Q4VZQOUk Real Player G2 Control component contains a remote code execution vulnerability because it allows 'javascript:' URIs to be passed as the argument, which is...

6.5AI score
SaveExploits0
NVD
NVD
added 2026/09/08 2:17 p.m.7 views

CVE-2026-73319

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

6.1CVSS0.00286EPSS
SaveExploits2References5
EUVD
EUVD
added 2026/09/08 1:19 p.m.9 views

EUVD-2026-72756

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

6.1CVSS6.1AI score0.00286EPSS
SaveExploits2References3
CVE
CVE
added 2026/09/08 1:19 p.m.14 views

CVE-2026-73319

XenForo versions prior to 2.3.13 are affected by a cross-site scripting (XSS) vulnerability in the dynamic redirect handler . The root cause is that unauthenticated attackers can craft a malicious javascript: URI that embeds the board hostname in the authority component and uses percent-encoded n...

6.1CVSS6.1AI score0.00286EPSS
SaveExploits2References5Affected Software1
Cvelist
Cvelist
added 2026/09/08 1:19 p.m.35 views

CVE-2026-73319 XenForo < 2.3.13 XSS via Dynamic Redirect Handler

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

6.1CVSS0.00286EPSS
SaveExploits2References5
NVD
NVD
added 2026/09/07 1:20 p.m.6 views

CVE-2026-86431

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...

7.2CVSS0.00224EPSS
SaveExploits1References3
EUVD
EUVD
added 2026/09/07 12:53 p.m.9 views

EUVD-2026-72389

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...

7.2CVSS5.6AI score0.00224EPSS
SaveExploits1References3
CVE
CVE
added 2026/09/07 12:53 p.m.10 views

CVE-2026-86431

league/commonmark (thephpleague/commonmark) versions &gt;= 2.7.0 and

7.2CVSS5.6AI score0.00224EPSS
SaveExploits1References3Affected Software1
Positive Technologies
Positive Technologies
added 2026/09/07 12:00 a.m.14 views

PT-2026-86797

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handler...

7.2CVSS5.6AI score0.00224EPSS
SaveExploits1References4
NVD
NVD
added 2026/09/04 12:17 p.m.5 views

CVE-2026-85601

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

5.4CVSS0.00165EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/04 11:30 a.m.34 views

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

5.4CVSS0.00165EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/04 11:30 a.m.7 views

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

5.1CVSS6.1AI score
SaveExploits0References4
CVE
CVE
added 2026/09/04 11:30 a.m.10 views

CVE-2026-85601

Grav Admin versions before 2.0.20 contain a cross-site scripting (XSS) vulnerability in the MarkdownEditor and MarkdownModal components. The root cause is unsanitized output from marked.parse() being injected into the DOM via Svelte's {@html} directive. Attackers can exploit this by injecting jav...

5.4CVSS5.8AI score0.00165EPSS
SaveExploits0References2
Rows per page
Query Builder