CVE-2026-61702

A flaw was found in CUPS. An information disclosure vulnerability allows an attacker to read files on the system by submitting a specially crafted print job containing directory traversal characters in the language attribute. Because the scheduler fails to validate path separators when processing...

cups: cups: Information disclosure via path traversal in banner processing

A flaw was found in CUPS. An information disclosure vulnerability allows an attacker to read files on the system by submitting a specially crafted print job containing directory traversal characters in the language attribute. Because the scheduler fails to validate path separators when processing...

CVE-2026-103418

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103418 Universal XSS via the HTML language attribute in Translation Services

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103418 Universal XSS via the HTML language attribute in Translation Services

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2026-103418

Firefox for iOS is vulnerable to a Universal XSS flaw because the browser directly interpolates the page’s HTML language attribute into translation JavaScript. This allows an attacker to execute code within the browser's privileged content world and bypass the page’s Content Security Policy . Thi...

EUVD-2026-98339

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

PT-2026-111300

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 157.1 Description Firefox for iOS directly interpolated the page HTML language attribute into translation JavaScript. This allows attacker-controlled markup to execute code within the privileged content world ...

CVE-2026-103418: Improper Neutralization of Input During Web Page Generation

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

Security Vulnerabilities fixed in Firefox for iOS 157.1 — Mozilla

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. Firefox for iOS could autofill saved credentials into a ne...

CVE-2026-58402

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out...

SUSE CVE-2015-2308

Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element...

CVE-2022-4524

The CVE-2022-4524 entry describes a cross-site scripting vulnerability in Roots soil Plugin up to 4.0.x, affecting language_attributes() in src/Modules/CleanUpModule.php due to improper neutralization of the language parameter. A remote attacker could exploit it; upgrading to 4.1.0 fixes this, wi...

FeehiCMS cross-site scripting vulnerability

FeehiCMS is a Php based CMS builder by Liufee Personal Developer. A security vulnerability exists in FeehiCMS version 2.0.8. An attacker can exploit this vulnerability to execute arbitrary code via the lang attribute of the html tag...

WordPress Cross-Site Scripting Vulnerability (CNVD-2017-38249)

WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers that support PHP and MySQL databases, or use WordPress as a content management system CMS. A cross-site scripting vulnerability exists in WordPress before 4.9.1. The vulnerability...

UBUNTU-CVE-2017-17093

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...

DEBIAN-CVE-2017-17093

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...

WordPress 4.3.0-4.9 - HTML Language Attribute Escaping

...

DEBIAN-CVE-2015-2308

Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element...

UBUNTU-CVE-2015-2308

Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element...