Lucene search
+L

38642 matches found

NVD
NVD
added 2026/08/23 2:16 p.m.9 views

CVE-2026-7808

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

9.8CVSS
SaveExploits0References2
NVD
NVD
added 2026/08/23 2:16 p.m.8 views

CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

9.8CVSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/23 1:34 p.m.10 views

EUVD-2026-64658

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

9.8CVSS4.6AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/23 1:34 p.m.18 views

CVE-2026-7808 justhtml before 1.16.0 Multiple Security Issues via Sanitization

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

9.8CVSS
SaveExploits0References2
CVE
CVE
added 2026/08/23 1:34 p.m.16 views

CVE-2026-7808

justhtml (Python HTML parsing library) before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active content such as [removed] or to survive sanitization, potentially leading to cross-site scripting . The issues primarily affect advanced usage rather than the default Just...

9.8CVSS4.6AI score
SaveExploits0References2
CVE
CVE
added 2026/08/23 1:34 p.m.13 views

CVE-2026-6827

justhtml before 1.17.0 (a Python HTML sanitization library) contains multiple security flaws in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces (SVG/MathML), HTML integration points such as SVG and MathML can survive sanitization and ...

6.1CVSS5.3AI score
SaveExploits0References2
EUVD
EUVD
added 2026/08/23 1:34 p.m.7 views

EUVD-2026-64655

justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces SVG/MathML, dangerous content such as HTML integration points SVG , MathML and mutation-XSS parser-differential payloads could...

6.1CVSS5.3AI score
SaveExploits0References2
EUVD
EUVD
added 2026/08/23 1:34 p.m.11 views

EUVD-2026-64652

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

9.8CVSS5.5AI score
SaveExploits0References2
CVE
CVE
added 2026/08/23 1:34 p.m.22 views

CVE-2026-5388

justhtml (Python HTML sanitizer library) before 1.15.0 contains multiple sanitization bypass vulnerabilities across URL sanitization helpers, HTML serialization, Markdown passthrough, and custom policy edge cases. Attackers can inject active HTML and JavaScript via vectors such as encoded javascr...

9.8CVSS5.5AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/23 1:34 p.m.18 views

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

9.8CVSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.90 views

osTicket < 1.12.1 - Cross-Site Scripting

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

6.1CVSS6.7AI score0.12613EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.312 views

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...

9.8CVSS7.9AI score0.99964EPSS
SaveExploits36References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.1046 views

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

6.1CVSS5.7AI score0.04458EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.42 views

WP Triggers Lite - Cross-Site Scripting

WP Triggers Lite WordPress plugin v2.5.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

7.1CVSS8.4AI score0.00571EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.6 views

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

6.1CVSS5.6AI score0.00377EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.32 views

NewsTicker <= 1.0 - Reflected Cross-Site Scripting

NewsTicker WordPress plugin v1.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft a maliciou...

6.1CVSS8.7AI score0.00579EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.56 views

Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

6.1CVSS7AI score0.0085EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.97 views

WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting

WordPress MF Gig Calendar plugin 1.1 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize or escape the id GET parameter before outputting back in the admin dashboard when editing an event. id: CVE-2021-24510 info: name: WordPress MF Gig Calendar =1.2 which...

6.1CVSS5.7AI score0.02721EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.58 views

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...

4CVSS4.5AI score0.00668EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.46 views

Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting

Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter. id: CVE-2019-14696 info: name: Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting author: pikpikcu severity: medium description: Open-School 3.0, and...

6.1CVSS5.6AI score0.15828EPSS
SaveExploits5References5
Rows per page
Query Builder