CVE-2019-11581

CVE-2019-11581 Atlassian JIRA Template injection vulnerability RCE Demo python CVE-2019-11581.py http://xx.xx.xx.xx:8080/ "Command" Vuln Version Download https://product-downloads.atlassian.com/software/jira/downloads/atlassian-jira-software-7.13.0-x64.exe Poc...

CVE-2026-32635-Angular-XSS-Mitigation-

CVE-2026-32635: Angular i18n Attribute XSS - Mitigation & Detection PoC 📌 Overview This repository contains an educational demonstration of the mitigation and detection for CVE-2026-32635 , a Cross-Site Scripting XSS vulnerability in Angular that affects internationalized i18n attributes...

Malicious code in @goparrot-dashboard/i18n (npm)

@goparrot-dashboard/i18n is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

MAL-2026-18503 Malicious code in @goparrot-dashboard/i18n (npm)

@goparrot-dashboard/i18n is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

CVE-2026-118257

A flaw was found in vue-i18n. The HTML sanitization mechanism fails to properly neutralize inline frame iframe srcdoc attributes when processing translated content. A remote attacker could exploit this vulnerability by injecting malicious parameters or translation data into applications configure...

CVE-2026-118256

A flaw was found in vue-i18n. When parameter escaping is enabled, the library fails to properly sanitize named interpolation values if a translation call contains both list and named parameters. A remote attacker could exploit this vulnerability by supplying untrusted input to an application that...

@nitra/auth-components (>=1.2.0, <=3.8.7), @nitra/vite-boot (>=1.0.0, <=2.2.0) +1 more potentially affected by CVE-2026-118256 via petite-vue-i18n (>=9.14.5, <=10.0.8)

petite-vue-i18n NPM version =9.14.5, =1.2.0, =1.0.0, =2.2.0 - gptx-chatbot-ui 1.2.0 Source cves: CVE-2026-118256 Source advisory: OSV:GHSA-8RC2-428Q-7WW3...

element-two-test (0.0.4), openim-web (>=1.0.3, <=1.0.16) +4 more potentially affected by CVE-2026-118256 via @intlify/vue-i18n-core (>=12.0.0-alpha.1, <=12.0.0-alpha.4)

@intlify/vue-i18n-core NPM version =12.0.0-alpha.1, =1.0.3, =12.0.0-alpha.1, =12.0.0-alpha.1, =0.0.5, =0.1.1, =0.1.8 Source cves: CVE-2026-118256 Source advisory: OSV:GHSA-8RC2-428Q-7WW3...

GHSA-8RC2-428Q-7WW3 Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Summary When escapeParameter is enabled escapeParameterHtml in the Legacy API, Vue I18n escapes the interpolation parameters before formatting a message. escapeParams escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes...

Improper Encoding or Escaping of Output

Overview petite-vue-i18n is a Vue I18n lite version Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the escapeParams function in packages/core-base/src/translate.ts, when a translation call passes both list and named interpolation values...

3h1-ui (>=1.0.46, <=3.0.0-next.266), 3t-ui (>=0.0.7, <=0.0.9) +2415 more potentially affected by CVE-2026-118256 via vue-i18n (>=9.0.0-beta.8, <=11.4.13)

vue-i18n NPM version =9.0.0-beta.8, =1.0.46, =0.0.7, =0.5.0, =0.0.0, =0.0.0, =0.1.9, =0.0.292, =0.0.292, =0.0.237, =2.0.0-dev.838f140, =3.0.1, =0.1.0, =0.15.0, =1.1.5 and more Source cves: CVE-2026-118256 Source advisory: OSV:GHSA-8RC2-428Q-7WW3...

element-two-test (0.0.4), openim-web (>=1.0.3, <=1.0.16) +2 more potentially affected by CVE-2026-118256 via vue-i18n (>=12.0.0-alpha.2, <=12.0.0-alpha.3)

vue-i18n NPM version =12.0.0-alpha.2, =1.0.3, =0.0.5, =0.1.1, =0.1.8 Source cves: CVE-2026-118256 Source advisory: OSV:GHSA-8RC2-428Q-7WW3...

petite-vue-i18n (9.2.0-alpha.7), vue-i18n (9.2.0-alpha.7) potentially affected by CVE-2026-118256 via @intlify/vue-i18n-core (9.2.0-alpha.7)

@intlify/vue-i18n-core NPM version 9.2.0-alpha.7 is affected by a known vulnerability. The following packages have a transitive dependency on @intlify/vue-i18n-core and may be impacted: - petite-vue-i18n 9.2.0-alpha.7 - vue-i18n 9.2.0-alpha.7 Source cves: CVE-2026-118256 Source advisory:...

npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

npm: Vue I18n: escapeParameter does not escape named values when the same call also passes a list vulnerability discovered by ? in WordPress npm petite-vue-i18n versions = 9.2.0-alpha.7, 11.4.14...

@nitra/auth-components (>=1.2.0, <=3.8.7), @nitra/vite-boot (>=1.0.0, <=2.2.0) +1 more potentially affected by CVE-2025-53892 +1 more via petite-vue-i18n (>=9.14.5, <=10.0.8)

petite-vue-i18n NPM version =9.14.5, =1.2.0, =1.0.0, =2.2.0 - gptx-chatbot-ui 1.2.0 Source cves: CVE-2025-53892, CVE-2026-118256 Source advisory: GHSA-8RC2-428Q-7WW3...

npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

npm: Vue I18n: escapeParameter does not escape named values when the same call also passes a list vulnerability discovered by ? in WordPress npm vue-i18n versions = 9.0.0-beta.5, 11.4.14...

Improper Encoding or Escaping of Output

Overview vue-i18n is an Internationalization plugin for Vue.js Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the escapeParams function in packages/core-base/src/translate.ts, when a translation call passes both list and named interpolation values...

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Summary When escapeParameter is enabled escapeParameterHtml in the Legacy API, Vue I18n escapes the interpolation parameters before formatting a message. escapeParams escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes...

@intlify/core (>=12.0.0-alpha.1, <=12.0.0-alpha.4), @intlify/devtools-types (>=12.0.0-alpha.1, <=12.0.0-alpha.4) +7 more potentially affected by CVE-2025-53892 +1 more via @intlify/core-base (>=12.0.0-alpha.1, <=12.0.0-alpha.4)

@intlify/core-base NPM version =12.0.0-alpha.1, =12.0.0-alpha.1, =12.0.0-alpha.1, =12.0.0-alpha.1, =1.0.3, =12.0.0-alpha.1, =12.0.0-alpha.1, =0.0.5, =0.1.1, =0.1.8 Source cves: CVE-2025-53892, CVE-2026-118256 Source advisory: GHSA-8RC2-428Q-7WW3...

3h1-ui (>=1.0.46, <=3.0.0-next.266), 3t-ui (>=0.0.7, <=0.0.9) +2415 more potentially affected by CVE-2025-53892 +1 more via vue-i18n (>=9.0.0-beta.8, <=11.4.13)

vue-i18n NPM version =9.0.0-beta.8, =1.0.46, =0.0.7, =0.5.0, =0.0.0, =0.0.0, =0.1.9, =0.0.292, =0.0.292, =0.0.237, =2.0.0-dev.838f140, =3.0.1, =0.1.0, =0.15.0, =1.1.5 and more Source cves: CVE-2025-53892, CVE-2026-118256 Source advisory: GHSA-8RC2-428Q-7WW3...