CVE-2026-57440

The EmbedVideo Extension for MediaWiki is vulnerable to HTML/JavaScript injection in versions prior to 4.1.0 . When the $wgEmbedVideoRequireConsent setting is disabled, the extension fails to sanitize video URLs passed into an iframe src attribute. An attacker can provide a malformed URL or ID us...

CVE-2026-57440: Improper Neutralization of Input During Web Page Generation

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe...

PT-2021-10890

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.6 Description A cross-site scripting XSS issue was found in the member/member content/init.html file due to the use of UEditor 1.4.3.3, specifically via the SRC attribute of an IFRAME element. Recommendations For YzmCMS versio...

PT-2019-12685

Name of the Vulnerable Software and Affected Versions Boostnote version 0.11.15 Description The issue is related to a XSS in the browser/components/MarkdownPreview.js component. It can be triggered via a label named flowchart, sequence, gallery, or chart. A crafted SRC attribute of an IFRAME...

CVE-2019-12184: Improper Neutralization of Input During Web Page Generation

There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136...

CVE-2019-12136: Improper Neutralization of Input During Web Page Generation

There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element...

CVE-2013-6017: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element...

PT-2011-3975

Name of the Vulnerable Software and Affected Versions Opera versions prior to 11.50 Description The issue allows remote attackers to cause a denial of service, resulting in an application crash. This is achieved by using injected script to set the SRC attribute of an IFRAME element. Recommendatio...

CVE-2005-4858: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in mimic2.cgi in mimicboard2 Mimic2 086 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters associated with the 1 name, 2 title, and 3 comment sections, as demonstrated by referencing a remote...