CVE-2026-83607

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. This vulnerability allows a remote attacker to inject malicious content, such as attributes or elements, into serialized XML or HTML documents. This occurs because the Document.createElement function does not properl...

CVE-2026-83607

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

EUVD-2026-69217

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

CVE-2026-83607

xmldom , a pure JavaScript XML DOM module, is affected by an element name injection vulnerability. Prior to @xmldom/xmldom 0.8.14 and 0.9.11 , and in xmldom 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name that XMLSerializer.serializeToString() emits verbatim....

CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

CVE-2026-44455

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the...

Cross-Site Scripting

Overview Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting XSS. The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 0.14.0 or later...

CVE-2015-1284

Removed by vendor...

Microsoft Internet Explorer Denial of Service Vulnerability (Mar 2010)

Internet Explorer is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Internet Explorer Denial of Service Vulnerability - Mar10

This host is installed with Internet Explorer and is prone to Denial of Service Vulnerability. OpenVAS Vulnerability Test $Id: secpodmsiedosvulnmar10.nasl 5394 2017-02-22 09:22:42Z teissa $ Microsoft Internet Explorer Denial of Service Vulnerability - Mar10 Authors: Antu Sanadi Copyright: Copyrig...

CVE-2010-1127

Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of the createElement method, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via crafted JavaScript code, as demonstrated by setting the 1...

CVE-2009-3019

Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of service application crash via JavaScript code that calls createElement to create an instance of the LI element, and then calls setAttribute to set the value...

Microsoft Internet Explorer DoS

Crash on recursive script creation with createElement...

CVE-2005-0110

In scope: CVE-2005-0110 affects Internet Explorer 6 on Windows XP SP2. The documented issue is that a web page containing a body element with an onclick tag (demonstrated via createElement) can bypass the file download warning dialog and potentially allow execution of arbitrary code by a remote a...