CVE-2026-48849-Roundcube-Webmail-Stored-XSS

CVE-2026-48849 - Stored XSS, HTML Injection & CSS Injection in Roundcube Webmail Overview This repository contains a Proof-of-Concept PoC for CVE-2026-48849 , a Stored Cross-Site Scripting XSS, HTML Injection, and CSS Injection vulnerability in Roundcube Webmail. The vulnerability allows...

Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Proof of Concept: CVE-2024-42008 and CVE-2024-42010 This proof of concept PoC demonstrates the exploitation of two vulnerabilities in Roundcube Webmail that enable CSS injection and a cross-site scripting XSS. The attack consists of two stages: 1. XSS via malicious XML attachment CVE-2024-42008...

CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC Exploit alt text ExploitDB Dompdf versions 1.2.1 are vulnerable to Remote Code Execution RCE by injecting CSS into the data. The file can be tricked into storing a malicious font with a .php file extension in its font cache, which can later be executed b...

CVE-2026-109810 CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)

SAP NetWeaver Application Server Java Web Dynpro Java does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser...

CVE-2026-109810 CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)

SAP NetWeaver Application Server Java Web Dynpro Java does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser...

CVE-2026-123529

Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...

CVE-2026-123529 Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color

Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...

CVE-2026-123529 Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color

Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...

EUVD-2026-119414

Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...

CVE-2026-123529

Vikunja versions prior to 2.7.1 are vulnerable to a stored CSS injection vulnerability. The issue stems from unsanitized table-cell data-background-color attributes within the TipTap component. Authenticated users with project write access can exploit this by storing crafted task descriptions or ...

CVE-2026-123529 Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color

Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...

CVE-2026-123529: go-vikunja vikunja: Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write…

Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...

PT-2026-139810

Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...

CVE-2026-123850

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives...

EUVD-2026-118353

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives...

CVE-2026-123850

In JetBrains YouTrack versions prior to 2026.2.19422 , a cSS injection vulnerability exists within Mermaid diagrams . This issue is triggered via configuration directives , leading to potential integrity impacts as the rendered UI layer can be manipulated. No specific exploits or in-the-wild expl...

CVE-2026-123850

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives...

CVE-2026-123850: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives...

CLEANSTART-2024-SU96222 attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy

CVE-2022-31744 affects multiple packages. An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. See references for individual vulnerability details...

Security update for roundcubemail (important)

openSUSE Security Update: Security update for roundcubemail Announcement ID: openSUSE-SU-2026:0361-1 Rating: important References: 1271471 1271472 1271474 1271475 1271476 1271477 1275317 1275318 1275319 1275320 1275321 1275322 1275323 1275324 1275325 1275445 1275552 1279459 Cross-References:...