GHSA-4MF4-73J6-MVRW djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Impact Many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a...

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Impact Many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a...

CVE-2026-92593 Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl - View::renderObjectTemplate sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml. Because Craft/Yii HMAC tokens are not...

CVE-2026-92593

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794. The Controller::getPostedRedirectUrl() → View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit introduced a self-signing oracle in Cp::elementLabelHtml(). Because Craft/Yii HMAC token...

CVE-2026-92592

Craft CMS 4.8.0–4.18.5 and 5.0.0–5.10.12 are affected by a remote code execution vulnerability (CVSS 3.1 score 8.8 High ). The root cause is that the HMAC signature for the license-shun cookie is not bound to its purpose—Yii's cookieValidationKey derives from the same Craft securityKey used for s...

CVE-2026-92592 Craft CMS before 4.18.6 Remote Code Execution via signed cookie

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-92718

Nuclei (ProjectDiscovery) versions from 3.7.0 before 3.11.1 contain a template signature bypass due to a cache that relies solely on file modification time rather than content checksums. An attacker with local access and low privileges can replace a signed template with unsigned malicious content...

EUVD-2026-80901

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary...

CVE-2026-92718 Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary...

CVE-2026-92718 Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary...

CVE-2026-92381

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decodestring of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be...

CVE-2026-92381 PbootCMS Template Rendering ContentController.php decode_string cross site scripting

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decodestring of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be...

EUVD-2026-80820

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decodestring of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-86445

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, whi...

CVE-2026-92593: Improper Control of Generation of Code

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl - View::renderObjectTemplate sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml. Because Craft/Yii HMAC tokens are not...

PT-2026-94109

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.8.0 through 4.18.5 Craft CMS versions 5.0.0 through 5.10.12 Description An issue exists where the software signs an authenticated user's attacker-controlled license-shun cookie using the same key and format used to validat...