https-nj.gov---CVE-2018-14042

https-nj.gov---CVE-2018-14042 Vulnearability Report of the New Jersey official site In Bootstrap prior to 4.1.2, XSS is possible in the main collapse data attribute. The data-target attribute, the data-parent attribute and the data-container is vulnerable to Cross-Site Scripting attacks. Test...

CVE-2026-124686

Progress Kendo UI for jQuery versions prior to 2026.4.1111 are vulnerable to a JavaScript Code Injection via the kendo.init() function. The root cause is that the function compiles data-* attribute values using new Function when an invalid JSON object is provided. An attacker with low privileges ...

EUVD-2026-123549

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init compiles data- attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widg...

CVE-2026-124686

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init compiles data- attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widg...

CVE-2026-124686 JavaScript Code Injection through kendo.init() in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init compiles data- attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widg...

PT-2026-145259

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init compiles data- attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widg...

CVE-2026-124686: Progress Software Kendo UI for jQuery: In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new…

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init compiles data- attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widg...

CVE-2026-116884

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data- attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom...

CVE-2026-116884 SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data- attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom...

CVE-2026-116884 SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data- attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom...

CVE-2026-116884

SemanticMediaWiki versions 5.0.0 through 7.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw in the ext.smw.tooltip.tippy.js component. The root cause is the rendering of data-* attributes via innerHTML while allowHTML is enabled. An attacker with editor privileges can inject a .smw-...

CVE-2026-116884 SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data- attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom...

EUVD-2026-110712

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data- attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom...

Semantic MediaWiki cross-site scripting vulnerability

Semantic MediaWiki versions 5.0.0 through 7.3.1 contain a cross-site scripting vulnerability. This flaw arises because when allowHTML is enabled, ext.smw.tooltip.tippy.js renders data- attributes via innerHTML. Editors can insert .smw-highlighter span elements containing malicious data-content,...

WordPress YOOtheme Pro theme < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes

Author+ Stored XSS via UIkit Data Attributes vulnerability discovered by Pierre Rudloff in WordPress Theme yootheme versions 5.0.35...

PT-2026-114416

Name of the Vulnerable Software and Affected Versions Drupal Gin Admin Theme affected versions not specified Description An issue exists where the module does not sufficiently sanitize certain attributes, leading to cross-site scripting XSS, a flaw that allows attackers to inject malicious script...

CVE-2025-61682 Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0...

CVE-2025-61682 Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0...

EUVD-2025-210943

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0...

CVE-2025-61682 Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0...