CVE-2026-112289

Koalixcrm versions through 1.14.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists because malicious task titles are rendered unescaped by the Task.link_to_task() function. Staff users can inject scripts that execute in the context of an administrator's browser...

CVE-2026-112289 Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

CVE-2026-112289 Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

CVE-2026-112289 Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

CVE-2026-90497

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

CVE-2026-90497 Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

CVE-2026-90497 Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

EUVD-2026-76950

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

CVE-2026-90497: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

PT-2026-90789

Name of the Vulnerable Software and Affected Versions Fengoffice Feng Office versions prior to 3.11.13.12 Description A remote cross site scripting issue exists in the Task Title Output component. The problem occurs within the getTitle function located in the application/views/task/add task.php...

CVE-2026-35601 Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar propert...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

EUVD-2025-38293

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-63638: Improper Neutralization of Input During Web Page Generation

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-63638

The Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the "Task Title" and "Description (Optional)" fields do not adequately validate input when creating a new task. An attack...

PT-2025-45495

Name of the Vulnerable Software and Affected Versions Sourcecodester AI-Powered To-Do List App version 1.0 Description The application is susceptible to Cross-Site Scripting XSS attacks. Specifically, the "Task Title" and "Description Optional" fields are vulnerable when creating a new task. An...