CVE-2026-59942

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...

EUVD-2026-50060

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...

CVE-2026-59943

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the render process. An attacker can exhaust system resources and cause the PHP process to crash by submitting a specially crafted HTML document containing a high-entropy,...

EUVD-2005-0219

Malware in sbrugna...

Splunk Enterprise 9.0.0 < 9.0.4 (SVD-2023-0202)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0202 advisory. - In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting XSS through the error message in a...

CVE-2023-45878

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubricsvisualisesaveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set...

Splunk Enterprise < 9.0.4 XSS (SVD-2023-0202)

The version of Splunk installed on the remote host is prior to 9.0.4. It is, therefore, affected by a cross-site scripting vulnerability where a View allows for XSS through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. Note that Nessus h...

CVE-2023-22932 Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise

In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting XSS through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0...

CVE-2023-22932: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting XSS through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0...

hospitalcruzvermelha.pt Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1149290 Security Researcher MrRhino Helped patch 52 vulnerabilities Received 3 Coordinated Disclosure badges Received 3 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting hospitalcruzvermelha.pt websi...

Pinterest Browser Extension Injects Unwanted Code into 5K Websites

A buggy Mozilla Firefox browser extension for sharing links to Pinterest has automatically injected malformed code into at least 5,000 websites. The code injection in this instance was not malicious, but researchers at Sucuri, which discovered and reported the problem on Tuesday, said the inciden...

New Relic: Html injection in monitor name textbox

Hello guys, Details: Encoded image tag via HTML-Encoding is executed in Monitot failed email Payload: Plain text: Encoded: PoC: F100855 Remediation: Before sending an email - make sanitization / filtering / encoding of whole special characters. If you have any question, plz let me know Thanks, St...

Microsoft Outlook 2003 Security Policy Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11446/info Microsoft Outlook 2003 is reported prone to a security policy bypass vulnerability. It is reported that by including a base64 encoded image in an email and labeling that image in a sufficient manner, it is then...

DEBIAN-CVE-2007-5977

Cross-site scripting XSS vulnerability in dbcreate.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than...

DEBIAN-CVE-2005-0218

ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: RFC 2397 URL...

CVE-2005-0218

ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: RFC 2397 URL...

CVE-2005-0218

CVE-2005-0218 : ClamAV versions up to 0.80 are vulnerable. A remote attacker can bypass virus scanning by embedding a base64-encoded image in a data: URL, allowing malicious content to pass checks. The issue is documented across multiple advisories, indicating a vulnerability in the data: URL han...

Microsoft Outlook 2003 - Security Policy Bypass

Microsoft Outlook 2003 - Security Policy Bypass source: https://www.securityfocus.com/bid/11446/info Microsoft Outlook 2003 is reported prone to a security policy bypass vulnerability. It is reported that by including a base64 encoded image in an email and labeling that image in a sufficient...

Microsoft Outlook 2003 - Security Policy Bypass

source: https://www.securityfocus.com/bid/11446/info Microsoft Outlook 2003 is reported prone to a security policy bypass vulnerability. It is reported that by including a base64 encoded image in an email and labeling that image in a sufficient manner, it is then possible to reference this base64...