75771 matches found
CVE-2026-94448
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...
CVE-2026-94448
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...
GO-2026-6599 Reset context tracking on consecutive template expressions in html/template
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...
CVE-2026-107801
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share i...
CVE-2026-107798
jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to...
CVE-2026-107798 Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter
jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to...
CVE-2026-107798
The software jivejdon (from commit 595d8d22 through commit ee67a65e) is susceptible to a stored cross-site scripting (XSS) vulnerability within the default-enabled TextStyle filter . The root cause is the insertion of unvalidated URLs into anchor href attributes. This allows authenticated attacke...
CVE-2026-107798 Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter
jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to...
CVE-2026-107796 Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters
Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing...
CVE-2026-107796 Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters
Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing...
Server-Side Template Injection
Handlebars is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper enforcement of prototype-access restrictions in lookupProperty, which allows an attacker to bypass the deny list, access the Function constructor through a controlled template, and execute...
EUVD-2026-95214
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user...
CVE-2026-107396 Indico: Cross-Site-Scripting in link fields
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user...
Cross-site Scripting (XSS)
Overview enshrined/svg-sanitize is a SVG sanitizer for PHP Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sanitize process. An attacker can execute arbitrary JavaScript in the context of the affected web page by uploading a crafted SVG file that exploits a...
Exploit for CVE-2021-25646
Apache Druid Embedded JavaScript RCE CVE-2021-25646 Vulhub...
javascript-obfuscator
JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...
CVE-2026-107700
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...
EUVD-2026-95146
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...