CVE-2026-59895

A flaw was found in Hono, a web application framework. The cx function within hono/css improperly handles class names during server-side rendering. This allows an attacker to inject untrusted values into a JSX class attribute, leading to the injection of arbitrary markup. This could result in...

Parsedown Class-Name Injection

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

CASAP Automated Enrollment 跨站脚本漏洞

CASAP Automated Enrollment is an automated enrollment system from the CASAP organization. The goal of the project is to provide CASAP with an automated enrollment system to streamline the school process and make it more effective, efficient and easily retrievable. SourceCodester CASAP Automated...

Class-Name Injection

Tested on 1.8.0-beta-5 In safe mode with html markup disabled, it is possible to insert any classname into a code block like this: \js any-class-name with spaces code \ renders as: code infostring needs some cleanup here:...