14 matches found
CVE-2026-102626 LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the datemin attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted...
CVE-2026-102626
LimeSurvey Community Edition 7.4.0 is vulnerable to a Stored XSS flaw. An authenticated user with the global Surveys: create permission can inject a JavaScript-breaking value into the date_min attribute of a Date/Time question. Because the application fails to perform JavaScript-context encoding ...
CVE-2026-77608: Improper Neutralization of Input During Web Page Generation
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...
PT-2026-95499
Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions prior to 7.2.0 Description Semantic MediaWiki is an open-source extension for MediaWiki used for storing and querying data. The software fails to apply sufficient output-context encoding when the value parameter is...
BIT-DJANGO-2022-22818
The % debug % template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS...
django: Possible XSS via '{% debug %}' template tag
A flaw was found in Django. The % debug % template tag did not properly encode the current context, posing a Cross-site scripting attack vector XSS...
django: Possible XSS via '{% debug %}' template tag
A flaw was found in Django. The % debug % template tag did not properly encode the current context, posing a Cross-site scripting attack vector XSS...
GHSA-95RW-FX8R-36V6 Cross-site Scripting in Django
The % debug % template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS...
CVE-2022-22818
The % debug % template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS...
DEBIAN-CVE-2022-22818
The % debug % template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS...
PYSEC-2022-19
The % debug % template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS...
CVE-2022-22818
CVE-2022-22818 affects Django’s {% debug %} template tag. The issue: the tag does not properly encode the current context, enabling potential XSS. Affected versions: Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Remediation: upgrade to 2.2.27, 3.2.12, or 4.0.2 or newer (as pe...
