Jbin-website-secret-scraper

🎖️ Jbin will gather all the URLs from the website and then it will try to expose the secret data from them. It collects both URLs and JS links to scrape secrets out of it. Also if you are looking for a specific string in a page or want to run custom regex then you can do that too now with the new...

CVE-2026-57568

The photo-management tool Lychee is vulnerable to Stored XSS in versions prior to 7.6.0 . The root cause is that config/markdown.php enables allow_unsafe_links, allowing authenticated users with album-edit permissions to store javascript: URIs in photo or album Markdown descriptions. These descri...

CVE-2026-57568 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

CVE-2026-57568 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

CVE-2026-109288

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

EUVD-2026-97590

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

CVE-2026-109288: Improper Neutralization of Input During Web Page Generation

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

PT-2026-110705

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.4 Description A stored cross-site scripting issue exists in the MarkdownInlineTokens.svelte component. The software renders markdown link URLs into anchor hrefs without validating the URL scheme. This allows...

CVE-2026-108852

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to...

CVE-2026-108852 Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to...

CVE-2026-108852 Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to...

CVE-2026-108852

Deep Chat version 2.5.1 is vulnerable to a cross-site scripting (XSS) flaw due to a Markdown link validation bypass . The root cause is that the RemarkableConfig.createNew function disables Remarkable link validation, allowing attackers to inject javascript: links. Attackers can execute scripts i...

EUVD-2026-97003

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to...

CVE-2026-108852: Improper Neutralization of Input During Web Page Generation

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to...

EUVD-2026-95304

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to...

CVE-2026-107798

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to...

CVE-2026-107798 Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to...

CVE-2026-107798

The software jivejdon (from commit 595d8d22 through commit ee67a65e) is susceptible to a stored cross-site scripting (XSS) vulnerability within the default-enabled TextStyle filter . The root cause is the insertion of unvalidated URLs into anchor href attributes. This allows authenticated attacke...

CVE-2026-107798: Improper Neutralization of Input During Web Page Generation

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to...

CVE-2026-91146: Improper Neutralization of Input During Web Page Generation

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...