CVE-2026-100172 Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes

The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...

EUVD-2026-87064

The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...

CVE-2026-100172

The AIL Framework (ail-project/ail-framework) is vulnerable to a stored cross-site scripting (XSS) flaw in two Jinja2 templates: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. The root cause is the interpolation of dynamic values (such as ic...

CVE-2026-100172 Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes

The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...

CVE-2026-100172: Improper Neutralization of Input During Web Page Generation

The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...

CVE-2026-16604

The Passster (also known as Content Protector ) WordPress plugin versions prior to 4.3.6 is vulnerable to unauthenticated protected content disclosure . The root cause is that the plugin outputs password-protected block content in the public page response before performing password verification. ...

CVE-2026-39853

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS7 signature, the code copies the digest value from a parsed...

CVE-2026-39853 osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verification

osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS7 signature, the code copies the digest value from a parsed...

CVE-2023-50550

layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...

CVE-2025-47536

Deserialization of Untrusted Data vulnerability in keywordrush Content Egg content-egg allows Object Injection.This issue affects Content Egg: from n/a through = 7.0.0...

CVE-2024-10316

CVE-2024-10316 involves the Stratum – Elementor Widgets WordPress plugin. The vulnerability affects all versions up to and including 1.4.4 and resides in includes/templates/content-switcher.php, enabling authenticated attackers with Contributor+ privileges to exfiltrate sensitive template data (p...

GHSA-RCVR-8WHX-3M5P Layui cross-site scripting (XSS) vulnerability

layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...

Layui cross-site scripting (XSS) vulnerability

layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...

CVE-2023-50550

layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...

CVE-2023-50550

layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...

CVE-2023-50550

layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...

Cross site scripting

layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...

PT-2023-31585 · Layui · Layui

Name of the Vulnerable Software and Affected Versions: layui versions up to v2.74 Description: The issue is a cross-site scripting XSS vulnerability. It occurs via the data-content parameter. Recommendations: For versions up to v2.74, as a temporary workaround, consider restricting the use of the...

CVE-2023-50550: Improper Neutralization of Input During Web Page Generation

layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...

layui Cross-Site Scripting Vulnerability

Layui is Layui open source Web UI component library that follows the original development model . A cross-site scripting vulnerability exists in versions prior to layui v2.74, which stems from the inclusion of cross-site scripting in the data-content parameter...