PT-2026-98242

Name of the Vulnerable Software and Affected Versions code16 Sharp versions prior to 9.22.5 Description A stored cross-site scripting issue exists in the rich-text editor because the HTML sanitizer allows the srcdoc attribute on iframe elements. While markup within srcdoc is HTML-encoded during...

PT-2026-28178

Name of the Vulnerable Software and Affected Versions Sharp versions prior to 9.20.0 Description Sharp, a content management framework for Laravel, has an issue in its file upload functionality. The ApiFormUploadController accepts a client-controlled validation rule parameter that is passed...

Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

A Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser...

PT-2025-45695

A Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser...

code16 Sharp vulnerable to Cross Site Scripting (XSS)

code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting XSS src/Form/Fields/SharpFormUploadField.php...

CVE-2025-61457

code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting XSS src/Form/Fields/SharpFormUploadField.php...

CVE-2025-61457: Improper Neutralization of Input During Web Page Generation

code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting XSS src/Form/Fields/SharpFormUploadField.php...

CVE-2025-61457

The code16 Sharp library (version v9.6.6 ) is vulnerable to Cross-Site Scripting (XSS) within the src/Form/Fields/SharpFormUploadField.php component. The root cause is improper input validation and output encoding , which allows an attacker to inject and execute arbitrary malicious scripts in a v...

PT-2025-42928

Name of the Vulnerable Software and Affected Versions code16 Sharp version 9.6.6 Description The software contains a Cross Site Scripting XSS issue located in src/Form/Fields/SharpFormUploadField.php. Recommendations At the moment, there is no information about a newer version that contains a fix...