11615 matches found
CVE-2026-64638
CVE-2026-64638 // XSS2Shell 针对 CVE-2026-64638 ( XSS2Shell )向量的技术分析与防御性缓解矩阵,这是 WordPress Core 身份验证界面解析过程中的一个严重不一致缺陷,可借助浏览器原语将预认证的反射型跨站脚本(XSS)链式利用,最终实现远程代码执行(RCE)。 🛠️ 执行摘要 向量 ID: CVE-2026-64638 代号: XSS2Shell 严重性: 高(CVSS 4.0: 8.9) CWE 分类: CWE-79(在生成网页时对输入的错误中和) 发现者: pwn.ai 利用状态: 已有公开详情;需要立即更新。 🔬...
EUVD-2026-78833
Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting XSS via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script concrete/js/features/imagery/frontend.js re-parses the attribute-decoded caption as HTML through jQuery's...
CVE-2026-81894 Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field
Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting XSS via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script concrete/js/features/imagery/frontend.js re-parses the attribute-decoded caption as HTML through jQuery's...
CVE-2026-91944
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...
CVE-2026-91942
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...
EUVD-2026-78801
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...
CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...
CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...
CVE-2026-91944
crawl4ai versions before 0.9.3 are affected by a DOM-based XSS in the Playground UI. The root cause is in the forceHighlightElement() function, which assigns textContent back to innerHTML, causing JSON responses to be re-parsed as HTML. An attacker can inject malicious scripts via crawled page co...
CVE-2026-91942
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Docker Playground UI . The root cause is that untrusted crawl results are assigned to element.innerHTML, allowing an attacker to craft malicious PDFs with event-handler markup that execute JavaScript in t...
EUVD-2026-78799
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...
CVE-2026-91942 crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...
CVE-2026-92069
Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
CVE-2026-92059
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
CVE-2026-92041
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
CVE-2026-92037
Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
CVE-2026-92039
Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
CVE-2026-92042
Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
DEBIAN-CVE-2026-92030
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...
CVE-2026-92030
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...