CVE-2026-18801

OpenMeter is affected by a stored/second-order SQL injection in the handling of customer usage-attribution values. A user who can create or update a customer can store a crafted value in usageAttribution.key or usageAttribution.subjectKeys, which is later incorporated into a ClickHouse WITH map(....

CVE-2026-18801

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is...

PYSEC-2026-3419 wger has Stored XSS via Unescaped License Attribution Fields

Stored XSS via Unescaped License Attribution Fields Summary The AbstractLicenseModel.attributionlink property in wger/utils/models.py constructs HTML strings by directly interpolating user-controlled fields licenseauthor, licensetitle, licenseobjecturl, licenseauthorurl, licensederivativesourceur...

Wger Has Stored XSS Via Unescaped License Attribution Fields

Stored XSS via Unescaped License Attribution Fields Summary The "AbstractLicenseModel.attributionlink" property in "wger/utils/models.py" constructs HTML strings by directly interpolating user-controlled fields "licenseauthor", "licensetitle", "licenseobjecturl", "licenseauthorurl",...

wger has Stored XSS via Unescaped License Attribution Fields

Stored XSS via Unescaped License Attribution Fields Summary The AbstractLicenseModel.attributionlink property in wger/utils/models.py constructs HTML strings by directly interpolating user-controlled fields licenseauthor, licensetitle, licenseobjecturl, licenseauthorurl, licensederivativesourceur...

GHSA-6F54-QJVM-WWQ3 wger has Stored XSS via Unescaped License Attribution Fields

Stored XSS via Unescaped License Attribution Fields Summary The AbstractLicenseModel.attributionlink property in wger/utils/models.py constructs HTML strings by directly interpolating user-controlled fields licenseauthor, licensetitle, licenseobjecturl, licenseauthorurl, licensederivativesourceur...