SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth "to" Parameter

SiYuan 2.9.0 through 3.8.6 serves the unauthenticated /check-auth authorization page app/stage/auth.html with a script that assigns the to query parameter to window.location.href without scheme validation. A crafted link whose to value is a javascript: URI executes script in the kernel origin onc...

cve-2016-1764

PoC Exploit Code for CVE-2016-1764 Recovery of Plaintext iMessage Data Without Breaking Crypto Authors Shubham Shah from Bishop Fox Joe DeMesy from Bishop Fox Matthew Bryant CVE-2016-1764 Vendor: Apple Release Date: April 8, 2016 Patch Date: March 21, 2016 Systems Affected: Messages on OSX Mounta...

CVE-2026-75599

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. Wh...

CVE-2026-75599

The home inventory system HomeBox is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in versions prior to 0.27.0 . The root cause is the maybeUrl() utility, which fails to restrict URL schemes when processing markdown-style links in entity custom-field values . An authenticated attacker ca...

CVE-2026-75599 HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. Wh...

CVE-2026-75599 HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. Wh...

RealPlayer_G2_RCE

Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Remote Code Execution Vulnerability Video demo: https://www.youtube.com/watch?v=9c9Q4VZQOUk Real Player G2 Control component contains a remote code execution vulnerability because it allows 'javascript:' URIs to be passed as the argument, which is...

CVE-2026-73319

CVE-2026-73319: JavaScript URI accepted as a dynamic redirect XenForo before 2.3.13 accepts a same-host javascript: URI as a dynamic redirect and later assigns it to window.location. What happens Server-side redirect validation rejects foreign hosts but does not require HTTP or HTTPS. A URL shape...

CVE-2026-66911

Zimbra is vulnerable to stored cross-site scripting XSS via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when...

CVE-2026-66911 Stored Cross-Site Scripting in Zimbra

Zimbra is vulnerable to stored cross-site scripting XSS via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when...

CVE-2026-66911

Zimbra is vulnerable to a stored cross-site scripting (XSS) flaw involving the Content-Location MIME header in email attachments. The root cause is a lack of sanitization of this header, allowing an attacker to inject a javascript: URI. An unauthenticated remote attacker can send a crafted email;...

EUVD-2026-112941

Zimbra is vulnerable to stored cross-site scripting XSS via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when...

CVE-2026-66911: Synacor Zimbra Collaboration: Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments

Zimbra is vulnerable to stored cross-site scripting XSS via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when...

PT-2026-132282

Zimbra is vulnerable to stored cross-site scripting XSS via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when...

Cross-site Scripting (XSS)

Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the xlink:href attribute being unfiltered in exported SVG output. The AST.ts sanitizer omits...

RainLab-User-Open-Redirect

RainLab User Plugin - Open Redirect Vulnerability Vulnerab...

CVE-2026-116167

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking...

EUVD-2026-109428

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking...

CVE-2026-116167

SiYuan versions 2.9.0 before 3.8.7 are vulnerable to a cross-site scripting (XSS) flaw on the unauthenticated /check-auth page. The root cause is a lack of scheme validation when the application assigns the to parameter to window.location.href. An attacker can provide a crafted link using a javas...

CVE-2026-116167 SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter

SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that executes after victim login, invoking...