GHSA-Q2J8-X8HF-63CH Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

Vulnerability Details Component: getgrav/grav core File: system/src/Grav/Common/Security.php Function: detectXss all six entries in the $patterns array use the PCRE u modifier, invoked from Grav\Common\Data\Validation::checkSafety the save-time XSS gate for any non-security.xsswhitelist account's...

Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

Vulnerability Details Component: getgrav/grav core File: system/src/Grav/Common/Security.php Function: detectXss all six entries in the $patterns array use the PCRE u modifier, invoked from Grav\Common\Data\Validation::checkSafety the save-time XSS gate for any non-security.xsswhitelist account's...

CVE-2026-72832 Grav before 2.0.12 Stored XSS via quoted-attribute bypass

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...

CVE-2026-72832: Improper Neutralization of Input During Web Page Generation

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...

CVE-2026-41466

ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the checkValidHtmlText function within Security.php that fails to properly sanitize user input by only detecting specific patterns while returning unsanitized strings without output encoding. Attackers ca...

CVE-2026-41466

ProjeQtor is affected by a stored XSS in checkValidHtmlText() within Security.php, across versions 7.0 through 12.4.3. The vulnerability arises from inadequate sanitization (only pattern-based checks) and lack of output encoding, allowing attackers to inject payloads that are stored and executed ...

CVE-2026-41466 ProjeQtor < 12.4.4 Stored XSS via checkValidHtmlText()

ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the checkValidHtmlText function within Security.php that fails to properly sanitize user input by only detecting specific patterns while returning unsanitized strings without output encoding. Attackers ca...

CVE-2026-41466: Improper Neutralization of Input During Web Page Generation

ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the checkValidHtmlText function within Security.php that fails to properly sanitize user input by only detecting specific patterns while returning unsanitized strings without output encoding. Attackers ca...

CVE-2023-49034

Cross Site Scripting XSS vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files...

CVE-2024-31634

Cross Site Scripting XSS vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library...

CVE-2024-31634

Cross Site Scripting XSS vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library...

CVE-2024-31634

Cross Site Scripting XSS vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library...

CVE-2024-31634

Cross Site Scripting XSS vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library...

CVE-2024-31634

A Cross-Site Scripting (XSS) vulnerability exists in Xunruicms versions 4.6.3 and before . The flaw is located in the Security.php file within the \XunRuiCMS\dayrui\Fcms\Library catalog. A remote attacker can exploit this to execute arbitrary code, potentially performing malicious actions on the ...

CVE-2024-31634

Cross Site Scripting XSS vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library...

CVE-2024-31634: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library...

PT-2024-24170 · Xunruicms · Xunruicms

Name of the Vulnerable Software and Affected Versions: Xunruicms versions 4.6.3 and before Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via the Security.php file in the catalog XunRuiCMSdayruiFcmsLibrary. This enables the attacker to perform...

CVE-2023-49034

Cross Site Scripting XSS vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files...

PT-2024-13669 · Projeqtor · Projeqtor

Name of the Vulnerable Software and Affected Versions: ProjeQtOr version 11.0.2 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via a crafted script to the checkvalidHtmlText function in the ack.php and security.php files. This enables the attacker...

Projeqtor Cross-Site Scripting Vulnerability

Projeqtor is a PHP-based open source project management software from the Projeqtor community. The software is used to organize various functions required for multiple projects and is suitable for IT projects. A cross-site scripting vulnerability exists in Projeqtor version 11.0.2, which originat...