6 matches found
CVE-2026-66294
XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', but the...
EEF-CVE-2026-66294 XML injection in Saxy via unescaped CDATA section terminator
Summary XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', b...
CVE-2026-66294
The saxy XML encoder (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because Saxy.Encoder.cdata/1 fails to neutralize the ]]> substring. While other paths escape XML metacharacters, the CDATA path passes the payload byte for byte, allowing an attacker who can provide untrusted te...
CVE-2026-66294 XML injection in Saxy via unescaped CDATA section terminator
XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', but the...
EUVD-2026-118039
XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', but the...
CVE-2026-66294: qcam saxy: XML injection in the Saxy XML encoder
XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', but the...