2 matches found
CVE-2026-86431
league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...
7.2CVSS0.00388EPSS
SaveExploits1References3
CVE-2026-86431: Improper Neutralization of Input During Web Page Generation
league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...
7.2CVSS5.7AI score0.00388EPSS
SaveExploits1References5
20