CVE-2025-13401-XSS-Stored

Prueba de Concepto: XSS Almacenado en Autoptimize para imágenes encontradas en el contenido cuando la optimización de imágenes o la precarga está habilitada. En la versión 3.1.13, la función utiliza un enfoque de "lista negra" mediante pregreplace para eliminar atributos específicos como title,...

CVE-2026-84701

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

EUVD-2026-69792

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701

NocoBase is vulnerable to stored cross-site scripting (XSS) due to insufficient sanitization of rich text field values in the read renderer (specifically ReadPretty.tsx). An attacker with create permissions can inject arbitrary HTML with event handlers via the collection API, which then executes ...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

EUVD-2026-68325

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashadmin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's setacto...

dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution

A flaw was found in DOMPurify. When the setConfig function is used with an uponSanitizeAttribute hook, the ALLOWEDATTR allowlist is not properly cloned. This allows an attacker to register a hook that can permanently modify the shared allowlist, enabling the conditional allowance of dangerous...

dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution

A flaw was found in DOMPurify. When the setConfig function is used with an uponSanitizeAttribute hook, the ALLOWEDATTR allowlist is not properly cloned. This allows an attacker to register a hook that can permanently modify the shared allowlist, enabling the conditional allowance of dangerous...

CVE-2026-75838

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

CVE-2026-75838 DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

EUVD-2026-60602

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

EUVD-2026-60577

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

PT-2026-76938

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

PT-2026-84251

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.14 @xmldom/xmldom versions prior to 0.9.11 xmldom versions 0.6.0 and earlier Description The Element.setAttribute function calls the private createAttributename path without validating the attribute name...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the INPLACE sanitization process when a hook removes an element, leaving its detached descendants with executable event handlers. An attacker ca...

CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-14207 LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...