CVE-2026-57440

The EmbedVideo Extension for MediaWiki is vulnerable to HTML/JavaScript injection in versions prior to 4.1.0 . When the $wgEmbedVideoRequireConsent setting is disabled, the extension fails to sanitize video URLs passed into an iframe src attribute. An attacker can provide a malformed URL or ID us...

CVE-2026-57440: Improper Neutralization of Input During Web Page Generation

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe...

CVE-2019-12184: Improper Neutralization of Input During Web Page Generation

There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136...

CVE-2019-12136: Improper Neutralization of Input During Web Page Generation

There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element...

CVE-2013-6017: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element...

CVE-2005-4858: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in mimic2.cgi in mimicboard2 Mimic2 086 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters associated with the 1 name, 2 title, and 3 comment sections, as demonstrated by referencing a remote...