CVE-2026-111932

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

EUVD-2026-103299

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111932

The Coder platform versions before 2.29.17 , 2.30.0 (before 2.32.7 ), 2.33.0 (before 2.33.8 ), and 2.34.0 (before 2.34.2 ) are vulnerable to a stored HTML injection vulnerability. The root cause is the insufficient escaping of ApplicationName and LogoURL appearance settings when rendered into HTM...

CVE-2026-111932: Improper Neutralization of Input During Web Page Generation

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-53575

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-53575 EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-53575 EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

EUVD-2026-102103

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-53575

The open source customer relationship management application EspoCRM is vulnerable to a Persistent Cross-Site Scripting (XSS) flaw in versions prior to 9.3.9 . An authenticated administrator can inject crafted content into the applicationName setting using a CSP nonce injection . Because this inp...

EUVD-2026-96372

argocd-mcp Argo CD MCP Server through 0.9.0 contains a path traversal vulnerability in the deleteapplication tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositorie...

CVE-2026-108585 argocd-mcp through 0.9.0 Path Traversal via delete_application Tool

argocd-mcp Argo CD MCP Server through 0.9.0 contains a path traversal vulnerability in the deleteapplication tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositorie...

PT-2026-109675

Name of the Vulnerable Software and Affected Versions argocd-mcp Argo CD MCP Server versions prior to 0.9.1 Description A path traversal issue exists in the delete application tool. This occurs when the applicationName variable is not properly validated, allowing MCP clients or prompt-injected...

GO-2026-6267 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder...

PT-2026-82022

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder...

PT-2026-81999

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...

PT-2026-116500

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.29.17 Coder versions 2.30.0 through 2.32.6 Coder versions 2.33.0 through 2.33.7 Coder versions 2.34.0 through 2.34.1 Description Stored HTML injection occurs because the ApplicationName and LogoURL appearance settings...

CVE-2025-9737

A vulnerability was detected in O2OA up to 10.0-410. Affected is an unknown function of the file /xqueryassembledesigner/jaxrs/importmodel of the component Personal Profile Page. Performing manipulation of the argument description/applicationName/queryName results in cross site scripting. Remote...

CVE-2025-9735

A weakness has been identified in O2OA up to 10.0-410. This affects an unknown function of the file /xqueryassembledesigner/jaxrs/table of the component Personal Profile Page. This manipulation of the argument description/applicationName/queryName causes cross site scripting. The attack may be...