CVE-2026-42045

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, when LobeChat processes custom tags in the Render process of src/features/Portal/Artifacts/Body/Renderer/index.tsx, if no type match is found, it will choose to call the...

LobeHub 跨站脚本漏洞

LobeHub is an open-source AI dialogue framework developed by LobeHub. Versions of LobeHub prior to 2.1.48 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper filtering during the processing of custom tags, which could lead to cross-site scripting attacks and t...

Command Injection

Overview @lobehub/lobehub is a LobeHub - an open-source,comprehensive AI Agent framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application. Affected versions of this package are...

CVE-2021-47843

Tagstoo 2.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious payloads through files or custom tags. Attackers can execute arbitrary JavaScript code to spawn system processes, access files, and perform remote code execution on the victim's computer...

CVE-2021-47843 Tagstoo 2.0.1 - Stored XSS to RCE

Tagstoo 2.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious payloads through files or custom tags. Attackers can execute arbitrary JavaScript code to spawn system processes, access files, and perform remote code execution on the victim's computer...

CVE-2021-47843

The CVE-2021-47843 entry concerns Tagstoo 2.0.1, which is affected by a stored cross-site scripting (XSS) vulnerability in files or custom tags. The issue enables attackers to inject malicious payloads and execute arbitrary JavaScript code, potentially spawning system processes, accessing files, ...

EUVD-2026-2751

Tagstoo 2.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious payloads through files or custom tags. Attackers can execute arbitrary JavaScript code to spawn system processes, access files, and perform remote code execution on the victim's computer...

Tagstoo Cross-Site Scripting Vulnerability

Tagstoo is a tag-based file manager developed by Pablo Andueza. Version 2.0.1 of Tagstoo contains a cross-site scripting vulnerability. This vulnerability arises from improper handling of file or custom tag inputs, which may lead to storage-based cross-site scripting attacks...

The vulnerability of the Rails Html Sanitizer configuration tool for Rails applications stems from improper handling of input data during web page generation. This allows attackers to perform cross-site scripting attacks.

The vulnerability of the Rails Html Sanitizer configuration implementation relates to the embedding of content. If the application developer defines custom tags such as “math”, “style” or “svg” and “style”, this vulnerability can allow a remote attacker to perform cross-site scripting attacks...

CVE-2023-43874

Multiple Cross Site Scripting XSS vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu...

[SECURITY] Fedora 35 Update: php-twig3-3.4.3-1.fc35

The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...

[SECURITY] Fedora 35 Update: php-twig2-2.14.11-1.fc35

The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...

Sensio Labs Twig Injection Vulnerability

Sensio Labs Twig is a PHP template engine from the French company Sensio Labs that supports custom tags and filters and the creation of DSLs. Sensio Labs Twig is vulnerable to injection, which can be exploited by attackers to run arbitrary PHP functions...

Cross-Site Scripting (XSS)

ezsystems/ezplatform-admin-ui is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in custom tags allowing an attacker to inject and execute malicious javascript...

GHSA-9JP8-CWWX-P64Q XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...

XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...

GHSA-FXWM-RX68-P5VX XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...

ColdFusion 9-10 - Credential Disclosure Exploit

ColdFusion...

[SECURITY] Fedora 21 Update: php-twig-1.20.0-1.fc21

The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...

[SECURITY] Fedora 18 Update: php-twig-Twig-1.12.3-1.fc18

The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...