XSS-via-XML-Rendering

XSS via XML document This repo showcases how to exploit XH...

[SECURITY] Fedora 45 Update: xhtml1-dtds-1.0-20020801.26.fc45

This provides the DTDs of the Second Edition of XHTML 1.0, a reformulation of HTML 4 as an XML 1.0 application, and three DTDs corresponding to the ones defined by HTML 4. The semantics of the elements and their attributes are defined in the W3C Recommendation for HTML 4. These semantics provide...

CLEANSTART-2023-NC93847 xhtml_translate_entity in xhtml

Security vulnerability affects the epub2txt package. xhtmltranslateentity in xhtml...

CVE-2026-100257

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export...

EUVD-2026-90001

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export...

CVE-2026-100257

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export...

CVE-2026-100257

In JetBrains YouTrack versions prior to 2026.2.18991 , a vulnerability exists where Server-Side Request Forgery (SSRF) can occur via stored XHTML injection during the PDF export process. The provided documents do not specify the exact root cause or specific remediation steps beyond the affected v...

PT-2026-103304

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Stored XHTML injection allows for Server-Side Request Forgery SSRF, a technique where an attacker induces the server to make requests to an unintended location, during the PDF expor...

CVE-2026-100257: Server-Side Request Forgery (SSRF)

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export...

NPM: xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

NPM: xhtml-purifier has HTML attribute-injection sanitizer bypass that leads to XSS vulnerability discovered by ? in WordPress Npm xhtml-purifier versions = 0.4.1...

GHSA-J8R4-32C5-33RC xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any...

xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any...

CVE-2026-61784

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...

EUVD-2026-86325

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...

CVE-2026-61784 xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...

CVE-2026-61784

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...

CVE-2026-61784

The xhtml-purifier Node.js library (versions prior to 0.4.3 ) contains an HTML attribute-injection vulnerability in the attributeString() function of XHTMLPurifier.js. The root cause is a failure to HTML-entity-encode attribute values during serialization, allowing an attacker to use a double-quo...

CVE-2026-61784 xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...

PT-2026-98196

Name of the Vulnerable Software and Affected Versions xhtml-purifier versions prior to 0.4.3 Description The library fails to HTML-entity-encode attribute values during the serialization of sanitized output. In the attributeString function, attribute values are concatenated directly into...

CVE-2026-61784: Improper Neutralization of Input During Web Page Generation

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString XHTMLPurifier.js, around line 148 the attribute value ...