GHSA-PGWW-W46G-26QG AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

Summary The HTML specification requires that a MathML element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces...

justhtml has sanitization bypass in custom policies and programmatic DOM

Summary justhtml 1.17.0 fixes multiple security issues in sanitization, serialization, and programmatic DOM handling. Most of these issues affected advanced or custom configurations rather than the default safe path. Affected versions - justhtml , MathML , SVG / , and MathML text integration poin...

PHP 5 php_sprintf_appendstring()函数整数溢出漏洞

BUGTRAQ ID: 28392 CVECAN ID: CVE-2008-1384 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP formattedprint.c文件的printf函数存在整数溢出漏洞，能够执行PHP脚本的攻击者可能利用此漏洞提升权限。 在formattedprint.c文件的phpsprintfappendstring函数中： - ---formattedprint.c-start--- inline static void phpsprintfappendstringchar buffer, int pos, int siz...