PT-2026-35445

ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the checkValidHtmlText function within Security.php that fails to properly sanitize user input by only detecting specific patterns while returning unsanitized strings without output encoding. Attackers ca...

GHSA-6GGM-PWR9-R5H2 XSS in @leanprover/unicode-input-component

Impact Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. Patches The issue has been resolved in 0.2.0. Workarounds Replace the...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the JsoupHtmlTextExtractor function. An attacker can cause unbounded memory consumption leading to a denial of service by sending crafted HTML content that triggers excessive memory allocation. Details Denial o...

GHSA-HHXF-W8HJ-43W6 Moodle vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the fixnonstandardentities function in the KSES HTML text cleaning library weblib.php, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities...

Grafana Labs Arbitrary File Read (CVE-2018-19039)

An information disclosure vulnerability exists in Grafana. This vulnerability is due to insufficient handling of direct link image rendering of HTML text panels. A remote, authenticated attacker can exploit the vulnerability by creating a crafted HTML text panel and requesting a direct link image...

Directory traversal

Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows remote attackers to read arbitrary files via a request to a vendor-supplied CGI script that is used to read HTML text file, but that does not do any URI/path...

Adobe Flash Player Style Sheet Null Pointer Denial of Service (APSB13-15; CVE-2013-3329)

A denial of service vulnerability has been reported in Adobe Flash Player. The vulnerability is due to a NULL pointer value when applying malformed badly formatted HTML text field. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

CVE-2010-1619

CVE-2010-1619 affects Moodle’s KSES HTML text cleaning library (weblib.php) via the fix_non_standard_entities function. The vulnerability allows remote XSS by crafting HTML entities and is reported in Moodle 1.8.x prior to 1.8.12 and 1.9.x prior to 1.9.8. Related advisories describe multiple link...

FCKeditor 'CurrentFolder' Arbitrary File Upload

FCKeditor is installed on the remote host. It is an open source HTML text editor that is typically bundled with web applications such Dokeos, GForge, Geeklog, and Xoops, although it can also be installed on its own. The installed version of the software fails to sanitize input passed to the...