CVE-2026-103662

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662

A reflected cross-site scripting (XSS) vulnerability exists in the MISP legacy taxonomy tag management confirmation forms (specifically the add tag and disable tag forms). The flaw is caused by the application echoing a user-supplied tag name value from the request into the rendered HTML output w...

EUVD-2026-90577

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662: Improper Neutralization of Input During Web Page Generation

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

PT-2026-103758

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the dataheadermetadata, dataheadertaxonomycategory, and dataheadertaxonomytag parameters. These...

GHSA-MPJJ-4688-3FXG Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the dataheadermetadata, dataheadertaxonomycategory, and dataheadertaxonomytag parameters. These...

CVE-2025-66311

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...

CVE-2025-66311 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...

CVE-2025-66311 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...

CVE-2025-66311 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...

CVE-2025-66311

CVE-2025-66311 refers to a Stored XSS vulnerability in Grav’s admin interface. The issue is in the "/admin/pages/[page]" endpoint where un sanitized input could be injected into data[header][metadata], data[header][taxonomy][category], and data[header][taxonomy][tag], with payloads stored in page...

CVE-2025-66311: Improper Neutralization of Input During Web Page Generation

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...