CVE-2026-107379

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

CVE-2026-107379

The PHP SVG/XML sanitizer svg-sanitizer is vulnerable in versions prior to 1.0.0 due to a flaw in the src/Sanitizer.php file. Specifically, a crafted SVG DTD with a #FIXED attribute default can cause the cleanAttributesOnWhitelist() function to perform a double DOMElement::removeAttribute() call ...

CVE-2026-107379

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

CVE-2026-107379 enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

CVE-2026-107379 enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

CVE-2026-107379 enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

CVE-2026-107379: Allocation of Resources Without Limits or Throttling

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a FIXED attribute default to make cleanAttributesOnWhitelist perform a double DOMElement::removeAttribute call on the same attribute name in src/Sanitizer.php. The first removal deletes the...

CVE-2026-97897

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

EUVD-2026-87290

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97897 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97897

A security flaw exists in Krayin laravel-crm versions up to 2.2.5 . The vulnerability resides in the Sanitizer.php file of the TinyMCE Media Upload component, where improper processing allows for cross-site scripting (XSS) . This flaw can be triggered via a remote attack. To remediate this issue,...

CVE-2026-97897 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97897 Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-97897: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

PT-2026-99096

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.6 Description A remote cross-site scripting issue exists due to improper processing within the Sanitizer.php file of the TinyMCE Media Upload component. Cross-site scripting is a technique where malicio...

CVE-2025-67479

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from before 1.39.14, 1.43.4, 1.44.1; Cite: from before 1.39.14,...

CVE-2025-67479: Undefined Security Weakness

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from before 1.39.14, 1.43.4, 1.44.1; Cite: from before 1.39.14,...

CVE-2025-61638: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects...

Wikimedia MediaWiki security vulnerabilities

Wikimedia MediaWiki is a web application developed by the Wikimedia Foundation for building Wiki websites. There is a security vulnerability in Wikimedia MediaWiki, which stems from defects in the includes/Parser/CoreParserFunctions.Php and includes/Parser/Sanitizer.Php files. The following...

CVE-2025-61638

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects...