230 matches found
CVE-2022-23861
CVE-2022-23861: YSoft SafeQ における複数の格納型クロスサイトスクリプティング YSoft SafeQ Webアプリケーションの複数のフィールドを悪用して悪意のある入力を注入することができ、出力のサニタイズが行われていないため、任意のJSコードが実行されます。これらのフィールドは、SafeQ Webインターフェースにアクセスする正当なユーザーに対してXSS攻撃を実行するために利用される可能性があります。 協力: この脆弱性はMarian-Razvan Ilisanu氏との協力により発見されました。 NVD開示: この脆弱性の開示はこちらでご覧いただけます。...
CVE-2026-9809
CVE-2026-9809 CVE-2026-9809 は、Mautic 7（バージョン 7.0.0 から 7.1.1）に影響を与える格納型クロスサイトスクリプティング（Stored XSS）の脆弱性です。この欠陥は Projects コンポーネントに存在し、プロジェクト名がタグやホバーポップオーバーとして管理ページ（キャンペーン、メール、フォームなど）に表示される際に、適切な出力サニタイズが行われません。プロジェクトの作成または編集権限を持つ認証済みユーザーは、プロジェクト名に悪意のある HTML/JavaScript...
CVE-2026-5920
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...
CVE-2026-78364
The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...
EUVD-2026-67052
opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...
CVE-2026-64654
GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...
CVE-2026-4259
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations
Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...
CVE-2026-4336
The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and including, 2.4.7. This is due to the plugin calling htmlentitydecode on postcontent during rendering in the setdisplayvariables function View.FAQ.class.php, line...
CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...
CVE-2026-3108
Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences...
CVE-2026-1454
Affected product: WordPress plugin “Responsive Contact Form Builder & Lead Generation Plugin” (Lead Form Builder); vulnerable in all versions up to 2.0.1. Root cause: insufficient input sanitization in lfb_lead_sanitize() (omits certain field types from its whitelist) and an overly permissive wp_...
CVE-2025-15312
Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...
CVE-2025-15312
Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...
CVE-2025-15312
Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...
EUVD-2025-206830
Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...
CVE-2025-15312
CVE-2025-15312 describes an improper output sanitization vulnerability in Tanium Appliance (TanOS family) that affects output handling in the affected component. The public records consistently cite “improper output sanitization” as the root cause, with CVSS metrics indicating high impact to conf...
CVE-2025-15312 Tanium addressed an improper output sanitization vulnerability in TanOS.
Tanium addressed an improper output sanitization vulnerability in Tanium Appliance...
PT-2026-6606
Name of the Vulnerable Software and Affected Versions Tanium Appliance affected versions not specified Description Tanium Appliance is affected by an improper output sanitization issue. This could potentially allow for unintended consequences due to unsanitized output. Recommendations At the...
