@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

@logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default. 1. Unescaped C0 control characters in structured data values escapeStructuredDataValue in...

CVE-2025-65300

CVE-2025-65300 Descrizione CVE-2025-65300: Vulnerabilità di Cross-Site Scripting XSS Memorizzato nella piattaforma SaaS Coohom Data di divulgazione: 2025-10-28 Ultimo aggiornamento: 2025-10-28 Segnalatore: Phisit Pupiw Vendor: Coohom CWE: CWE-79 – Cross-Site Scripting Riepilogo È stata identifica...

owasp-java-encoder

OWASP Java Encoder Projekt Contextual Output Encoding ist eine Programmiertechnik, die notwendig ist, um Cross‑Site Scripting zu stoppen. Dieses Projekt ist eine einfach zu verwendende, einsatzbereite, leistungsstarke Java‑1.8+‑Encoder‑Klasse mit geringem Zusatzaufwand. Für detailliertere...

CVE-2026-9811

CVE-2026-9811 CVE-2026-9811 ist eine Schwachstelle vom Typ Stored Cross-Site Scripting Stored XSS, die Mautic 7 Versionen 7.0.0 bis 7.1.1 betrifft. Die Schwachstelle befindet sich in der Komponente Project Selector, in der Projektnamen, die über eine AJAX-Anfrage zurückgegeben werden, ohne...

CVE-2026-37196

CVE-2026-37196 – Cross-Site Scripting XSS Memorizzato in nirix traq v3.9.0 Panoramica Esiste una vulnerabilità di Cross-Site Scripting XSS Memorizzato in nirix traq v3.9.0 , in cui l'input fornito dall'utente nel campo di descrizione del ticket non viene sanificato correttamente prima di essere...

CVE-2025-25461

📌 CVE-2025-25461 - Cross-Site Scripting XSS Memorizzato in SeedDMS 6.0.29 📝 Descrizione Esiste una vulnerabilità di Cross-Site Scripting XSS Memorizzato in SeedDMS 6.0.29. Un utente o amministratore malintenzionato con il permesso "Aggiungi Categoria" può iniettare un payload XSS dannoso nel camp...

CVE-2025-52097

CVE-2025-52097 – XSS riflesso in InstantForum.NET v4.1.4 Questo repository contiene l'advisory pubblica, la prova di concetto e i materiali di supporto per CVE-2025-52097 , una vulnerabilità di cross-site scripting XSS riflesso identificata in InstantForum.NET v4.1.4. Riepilogo Prodotto:...

WSO2-2021-1261

WSO2-2021-1261: WSO2 ESB में एकाधिक क्रॉस-साइट स्क्रिप्टिंग अनुचित आउटपुट एन्कोडिंग के कारण, WSO2 ESB में कई क्रॉस-साइट स्क्रिप्टिंग XSS हमलों की पहचान की गई है। विक्रेता प्रकटीकरण: इस भेद्यता के लिए विक्रेता का प्रकटीकरण और समाधान यहाँ पाया जा सकता है। CVE क्यों नहीं? न मैंने और न ही विक्रेता ने...

CVE-2026-26211

Ekushey Project Manager CRM 5.0 is affected by a stored XSS vulnerability in the administrator-configured system name field. The value is written to the login page without output encoding, and its occurrence in an h4 element is parsed as markup, causing any injected HTML event handlers to execute...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - Umgehung von Rewrite-Regeln Entdecker: gregk4sec https://github.com/gregk4sec/cve Entdeckungsdatum: 2025-02-28 Betroffener Anbieter: Apache Betroffenes Produkt: Tomcat 9.0.x / 10.1.x / 11.0.x Schweregrad: Kritisch / Hoch CWE: CWE-116 Status: In Überprüfung / Behob...

CVE-2025-63588

CVE-2025-63588 Cross-Site Scripting XSS riflesso nella gestione del percorso cmsimplexh di CMSimpleXH CVSS v3.1 stimato: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 Medio CVE assegnato: CVE-2025-63588 Prodotti: CMSimpleXH - 1.8 Fornitore: CMSimpleXH - https://www.cmsimple-xh.org/ Sommario Esiste un...

SuperWebMailer - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 that allows keepalive.php XSS via a GET parameter. id: CVE-2023-38194 info: name: SuperWebMailer - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 that allows...

EyouCms v1.6.2 - Cross-Site Scripting

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /admin/twitter.php?activet. id: CVE-2023-41597 info: name: EyouCms v1.6.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: | EyouCms v1.6.2 was discovered to...

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 allowing XSS via crafted incorrect passwords. id: CVE-2023-38192 info: name: SuperWebMailer 9.00.0.01710 - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 allowi...

CVE-2026-53468

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

EUVD-2026-64169

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-53468 Typemill has Stored HTML Attribute Injection in Metadata Fields

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-53468

Typemill versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). The root cause is missing output encoding , allowing an authenticated user with permission to modify page metadata to inject arbitrary HTML attributes int...

CVE-2026-53468 Typemill has Stored HTML Attribute Injection in Metadata Fields

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-61399

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later,...