Joplin-CVE-2022-35131

Joplin CVE-2022-35131 XSS leading to RCE in Joplin affecting version 2.8.8 and earlier. Tested and works on Windows and Linux. Reported and fixed: 2022-06 Technical overview 1. Create a note with javascript payload as title POC:s bellow 2. Press Ctrl+P and search for something in the note or titl...

CVE-2025-5352

CVE-2025-5352 A stored Cross-Site Scripting XSS vulnerability has been identified in the Analytics component of lunary-ai/lunary. The issue arises because the NEXTPUBLICCUSTOMSCRIPT variable is injected directly into the DOM using dangerouslySetInnerHTML without proper sanitization or validation...

CVE-2025-14855-POC

CVE-2025-14855: SureForms WordPress Plugin Stored XSS Proof of Concept Target: WordPress Plugin "SureForms" Plugin Wordpress: https://wordpress.org/plugins/sureforms/ Vulnerability Type: Stored Cross-Site Scripting XSS CVE: CVE-2025-14855 Refer:...

CVE-2026-55422

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization the project has no DOMPurify or equivalent dependency. JSON...

CVE-2026-55422 conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization the project has no DOMPurify or equivalent dependency. JSON...

CVE-2026-55422

The conda-forge website is vulnerable to Stored DOM XSS due to the unsanitized use of dangerouslySetInnerHTML in two React components within the status dashboard. The root cause is that the site renders raw output—such as build logs and tracebacks—captured by the autotick bot (regro/cf-scripts) d...

CVE-2026-109558

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token t...

EUVD-2026-97881

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token t...

CVE-2026-109558

Versions 1.6.0 through 1.112.0 of EdgeEver are vulnerable to a stored cross-site scripting (XSS) vulnerability in the TemplatesPane.tsx component. The root cause is the rendering of template contentMarkdown as raw HTML using dangerouslySetInnerHTML without proper sanitization. An attacker can uti...

CVE-2026-109558 EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token t...

CVE-2026-109558 EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token t...

PT-2026-110934

Name of the Vulnerable Software and Affected Versions EdgeEver versions 1.6.0 through 1.112.0 Description A stored cross-site scripting issue exists in TemplatesPane.tsx where template contentMarkdown is rendered with raw HTML using dangerouslySetInnerHTML without proper sanitization. This allows...

CVE-2026-109558: Improper Neutralization of Input During Web Page Generation

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token t...

CVE-2026-105784: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...

CVE-2026-97868

A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...

CVE-2026-97868 sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting

A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...

CVE-2026-97868

The software sheshbabu zen (up to version 1.5.0 ) is vulnerable to a cross-site scripting (XSS) vulnerability. The root cause is the use of the dangerouslySetInnerHTML function within the features/notes/NotesEditor.jsx file of the Note Editor component. This flaw allows for remote initiation of a...

CVE-2026-97868 sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting

A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...