17 matches found
EUVD-2026-86384
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass...
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField. Patches The field must now explicitly configure SharpFormEditorField::RAWHTML in the toolbar to keep this behavior. When using the RAWHTML...
CVE-2026-100172
The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...
CVE-2026-100172 Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes
The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...
CVE-2026-100172
The AIL Framework (ail-project/ail-framework) is vulnerable to a stored cross-site scripting (XSS) flaw in two Jinja2 templates: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. The root cause is the interpolation of dynamic values (such as ic...
CVE-2026-61825
The code16/sharp Laravel-based framework is vulnerable to stored cross-site scripting (XSS) in versions before 9.22.5 . The flaw exists within the SharpEditorFormField component, where attacker-controlled content using the data-html-content attribute can bypass HTML sanitization to preserve and e...
CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...
CVE-2026-61825 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML...
EUVD-2026-46280
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...
SUSE CVE-2026-44727
Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyterserver render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default...
CVE-2024-5737
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default text/html is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0...
CVE-2022-27885
Maccms v10 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters...
CVE-2022-27887
Maccms v10 was discovered to contain a reflected cross-site scripting XSS vulnerability in /admin.php/admin/vod/data.html via the repeat parameter...
CVE-2022-27885
Maccms v10 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters...
CVE-2022-26573
Maccms v10 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters...
Maccms 跨站脚本漏洞
Maccms is a PHP-based film and television content management system CMS. v10 version of Maccms is vulnerable to a cross-site scripting vulnerability, which originates from the lack of a repeat parameter in /admin.php/admin/vod/data.html to check the data provided by the user and the output data...