CVE-2025-27108

dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's .replace opens up to potential Cross-site Scripting XSS vulnerabilities with the special replacement patterns beginning with $. Particularly, when the attributes of Meta tag from...

PT-2025-7633 · Unknown · Dom-Expressions

Name of the Vulnerable Software and Affected Versions: dom-expressions versions prior to 0.39.5 Description: The issue arises from the use of JavaScript's .replace function, which opens up to potential Cross-site Scripting XSS vulnerabilities with special replacement patterns beginning with $...

Remote Code Execution (RCE)

Joplin is vulnerable to Remote code execution RCE. The vulnerability is due to insufficient sanitization of tag attributes introduced by the Mermaid feature, allowing execution of untrusted HTML content within the Electron window...

Joplin 代码注入漏洞

Joplin is an open source note-taking and to-do list application from the individual developer Laurent Cozic. A code injection vulnerability exists in Joplin version 3.0, which stems from improper cleanup of tag attributes that can execute untrusted HTML content within an Electron window, resultin...

PT-2024-23548 · WordPress · Elegant Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Elegant Addons for elementor plugin for WordPress version 1.0.8 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's widgets due to insufficient input sanitization and output escaping on user-supplied...

Jeg Elementor Kit < 2.6.3 - Contributor+ Stored Cross-Site Scripting

Description The plugin is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to...

CVE-2024-1326

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and abo...

CVE-2024-1397

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on the 'titleTag' user supplied attributes. This makes it...

php-svg-lib security vulnerability

php-svg-lib is an open source SVG file parsing/rendering library from dompdf. A security vulnerability exists in versions of php-svg-lib prior to 0.5.1, which stems from the fact that parsing attributes passed to the use tag within an svg document may cause the system to enter infinite recursion,...

tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers

A flaw was found in rubygem-actionview when untrusted data such as the hash key for tag attributes are not properly escaped. This flaw allows an attacker to perform a Cross-site scripting attack...

SUSE CVE-2019-0230

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution...

SUSE CVE-2020-17530

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25...

Expression Language Injection in Apache Struts

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. Using forced OGNL evaluation on untrusted user input can lead to a...

Apache Struts 2 安全漏洞

A remote code execution vulnerability exists in Apache Struts, an open source web application architecture for developing Java EE web applications from the Apache Foundation, which stems from the use of mandatory OGNL evaluation in tag attributes for untrusted user input. An attacker could exploi...

Remote code execution in Apache Struts

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution...

GHSA-JC35-Q369-45PV Remote code execution in Apache Struts

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution...

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution...

Apache Struts Remote Code Execution Vulnerability

Forced Object-Graph Navigation Language OGNL evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution...

VulnCheck KEV: CVE-2020-17530

Forced Object-Graph Navigation Language OGNL evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution...

Remote code execution

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25...