45 matches found
CVE-2026-103321
MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...
CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...
CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...
CVE-2026-103321
MISP versions prior to the fix (applied after v2.5.48 ) are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability in the event graph preview feature. The root cause is a lack of server-side validation for the preview image field; the application renders this stored value into an HTML im...
EUVD-2026-89800
MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...
CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...
CVE-2026-103321: Improper Neutralization of Input During Web Page Generation
MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...
CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...
EUVD-2019-5513
Malware in sbrugna...
EUVD-2023-32276
Malicious code in bioql PyPI...
EUVD-2023-32275
Malicious code in bioql PyPI...
EUVD-2023-28090
Malicious code in bioql PyPI...
CVE-2023-28606
js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips...
CVE-2023-28607
js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip...
CVE-2023-24026
In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload...
CVE-2022-29531
An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name...
CVE-2019-14286
In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability...
CVE-2023-28607
js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip...
