42 matches found
EUVD-2026-81290
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...
CVE-2026-92590
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...
CVE-2026-92590 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...
CVE-2026-92590
Craft CMS versions 5.7.0 through 5.10.12 are affected by a stored cross-site scripting (XSS) vulnerability in the Generated Fields feature. The root cause is the disabling of Twig autoescaping combined with a failure to encode cached values , allowing content editors to inject malicious JavaScrip...
CVE-2026-92590 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...
CVE-2026-92590 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...
PT-2026-94107
Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.7.0 through 5.10.12 Description A stored cross-site scripting issue exists in the Generated Fields feature. The flaw occurs because Twig autoescaping is disabled and cached values are not encoded. This allows content edito...
CVE-2026-46628
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0...
EUVD-2026-44566
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0...
CVE-2026-46628
Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0...
PYSEC-2026-804 Django REST framework XSS Vulnerability
Django REST framework aka django-rest-framework before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping...
WS-2019-0037
django-rest-framework versions before 3.9.1 has an XSS vulnerability caused by disabled autoescaping in the default DRF Browsable API view templates...
EUVD-2022-6453
Malicious code in bioql PyPI...
CVE-2018-25045
Django REST framework aka django-rest-framework before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping...
SUSE CVE-2018-25045
Django REST framework aka django-rest-framework before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping...
GHSA-XQCF-HJ92-967M Django REST framework XSS Vulnerability
Django REST framework aka django-rest-framework before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping...
Django REST framework XSS Vulnerability
Django REST framework aka django-rest-framework before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping...
CVE-2018-25045
Django REST framework aka django-rest-framework before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping...