35 matches found
PT-2026-126345
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data- attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom...
CVE-2026-100172 Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes
The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...
CVE-2026-100172 Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes
The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...
CVE-2026-100172
The AIL Framework (ail-project/ail-framework) is vulnerable to a stored cross-site scripting (XSS) flaw in two Jinja2 templates: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. The root cause is the interpolation of dynamic values (such as ic...
EUVD-2026-87064
The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...
PT-2026-98837
Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description A stored cross-site scripting XSS issue exists in two Jinja2 templates used to render popovers for matched, tracked, or tagged content: var/www/templates/chats explorer/block message.ht...
CVE-2026-100172: Improper Neutralization of Input During Web Page Generation
The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...
CVE-2026-16604
The Passster (also known as Content Protector ) WordPress plugin versions prior to 4.3.6 is vulnerable to unauthenticated protected content disclosure . The root cause is that the plugin outputs password-protected block content in the public page response before performing password verification. ...
CVE-2026-39853
osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS7 signature, the code copies the digest value from a parsed...
CVE-2026-39853 osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verification
osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS7 signature, the code copies the digest value from a parsed...
CVE-2023-50550
layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...
CVE-2025-47536
Deserialization of Untrusted Data vulnerability in keywordrush Content Egg content-egg allows Object Injection.This issue affects Content Egg: from n/a through = 7.0.0...
CVE-2024-10316
CVE-2024-10316 involves the Stratum – Elementor Widgets WordPress plugin. The vulnerability affects all versions up to and including 1.4.4 and resides in includes/templates/content-switcher.php, enabling authenticated attackers with Contributor+ privileges to exfiltrate sensitive template data (p...
GHSA-RCVR-8WHX-3M5P Layui cross-site scripting (XSS) vulnerability
layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...
Layui cross-site scripting (XSS) vulnerability
layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...
CVE-2023-50550
layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...
CVE-2023-50550
layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...
CVE-2023-50550
layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...
