CVE-2026-39375

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

CVE-2026-39375 Frappe LMS has Stored XSS in Course Meta

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

CVE-2026-39375 Frappe LMS has Stored XSS in Course Meta

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

CVE-2026-39375

The Frappe Learning Management System (LMS) is vulnerable to stored cross-site scripting (XSS) in versions prior to 2.52.0 . An authenticated user with a course editing role can inject malicious JavaScript via meta tag fields within the Course Management module . The root cause is the lack of ade...

EUVD-2026-114195

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

CVE-2026-39375: frappe lms: Frappe Learning Management System (LMS) is a learning system that helps users structure their content

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

CSZ-CMS-Stored-XSS---Site-Settings

CSZ CMS Stored XSS v1.3.0 Author: Sergio Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Site Settings Menu. Attack Vectors: Scripting A vulnerability in the...

CVE-2023-41436-CSZ-CMS-Stored-XSS---Pages-Content

CSZ CMS Stored XSS v1.3.0 Author: Sergio CVE: 2023-41436 Description: Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Pages Content Menu component. Attack Vectors:...

EEF-CVE-2026-109823 Host filesystem path disclosure via DNS rebinding

Summary An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag wi...

CLEANSTART-2026-VH11927 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

CVE-2026-39823 affects multiple packages. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. See references for individual vulnerability details...

CLEANSTART-2026-RP71173 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the argo-cd package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-TC68391 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the external-dns package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-FK00511 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

CVE-2026-39823 affects multiple packages. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. See references for individual vulnerability details...

NPM: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

NPM: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead vulnerability discovered by ? in WordPress Npm quasar versions 2.22.0...

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Vulnerability Details File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js lines 149-176: getAttr and getHead Sink: injectServerMeta same file → ctx.headTags += getHeaddata, interpolated verbatim into the raw HTTP response by the production SSR template...

CLEANSTART-2026-MX72137 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the temporal-server package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-GO32360 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the cri-tools package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-EF65373 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

CVE-2026-39823 affects multiple packages. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. See references for individual vulnerability details...

CLEANSTART-2026-PB65186 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the crane package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-MY04156 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the minio-operator package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...