WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...

WordPress HTML5 Video Player - SQL Injection

WordPress HTML5 Video Player plugin is vulnerable to SQL injection. An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks. id: CVE-2024-1061 info: name: WordPress HTML5 Video Player - SQL Injection author: xxcdd severity: critical description: | WordPress HTM...

CVE-2026-54743

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-54743 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-54743 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-54743

Lemmy (a fediverse link aggregator and forum) is affected by a stored XSS in lemmy-ui prior to version 0.19.19-beta.1 . The root cause lies in src/shared/markdown.ts, where mdToHtml returns a raw __html object injected by Inferno without a sanitizer pass. The [email protected] plugin,...

CVE-2026-73491

A flaw was found in Loofah. The Loofah::HTML5::Scrub.alloweduri? function fails to properly detect javascript: Uniform Resource Identifiers URIs when their scheme is split or prefixed with HTML5 named whitespace character references, such as or . This vulnerability allows a remote attacker to cra...

Linux Distros Unpatched Vulnerability : CVE-2026-73491

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2,...

CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

UBUNTU-CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73492 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

EUVD-2026-57628

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73491 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73491 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73491 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73491

Loofah 2.25.0–2.25.2 contains a vulnerability in Loofah::HTML5::Scrub.allowed_uri? where javascript: URIs are not rejected if the scheme is split or prefixed by HTML5 named whitespace references ( , ). CGI.unescapeHTML leaves these references intact, causing allowed_uri? to report a URL as safe e...

EUVD-2026-57626

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...