osticket-stored-xss-security-assessment

CVE-2026-36214 - osTicket Stored XSS via Bootstrap Tooltip Consultant-Style Cybersecurity Report Professional vulnerability assessment report for osTicket stored cross-site scripting, including business impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details ---|--- Report...

Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion

A directory traversal vulnerability in the JE Form Creator comjeformcr component for Joomla!, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE -- the original researcher states that the...

CVE-2026-36214

CVE-2026-36214 - Stored Cross-Site Scripting XSS in osTicket via Vulnerable Bootstrap Tooltip Component Description Enhancesoft osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 ship with the known-vulnerable Bootstrap Tooltip 3.3.4 component CVE-2019-8331, which introduces a...

CVE-2019-8331

Eng Description CVE-2019-8331 is a Cross-Site Scripting XSS security vulnerability found in Bootstrap, a JavaScript library widely used for developing websites and mobile applications. This vulnerability occurs because Bootstrap does not properly sanitize data sent via thedata-template attribute ...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Vulnearability Report of the New Jersey official site Bootstrap 4.0.0 Found in https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Vulnerability info: Medium 28236 XSS in data-template, data-content and data-title properties of tooltip/popover...

CVE-2026-102279

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279 Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

PT-2026-102378

Name of the Vulnerable Software and Affected Versions Laravel versions prior to 12.69.0 Laravel versions prior to 13.30.0 Description Exception debug pages configured with APP DEBUG=true pass attacker-controlled input to a Tippy.js tooltip. Because the tooltip is configured with allowHTML set to...

CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100176

The AIL Framework username timeline feature is vulnerable to stored cross-site scripting (XSS) . The application stores usernames from chats and crawled forums without character restrictions. When an authenticated analyst views the timeline, the client-side JavaScript file var/www/static/js/d3/ti...

CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may add tooltips and help text to these forms. Some Webform tooltips and help text were not sufficiently sanitized, resulting in possible cross-site...

CVE-2026-91130

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-91130

Prior to version 2026.7.0 , the Statistics Graph card in Home Assistant (specifically in src/components/chart/statistics-chart.ts) was vulnerable to Cross-Site Scripting (XSS) . The application failed to escape entity names passed through getStatisticLabel and computeStateName, as well as interpo...

CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

PT-2026-97016

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2026.7.0 Description An authenticated user or a malicious integration provider can execute a Cross-Site Scripting XSS attack against users who view a Statistics Graph card. The issue occurs because the...

CVE-2026-91130: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...