CVE-2026-118254

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the...

CVE-2026-118254

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the...

CVE-2026-118252 Highcharts Dashboards: sidebar component labels are parsed as HTML

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing...

CVE-2026-118252

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing...

CVE-2026-118252

Highcharts JS, a JavaScript charting library, is vulnerable to Cross-Site Scripting (XSS) in its Dashboards edit-mode sidebar . Specifically, versions 1.0.0 through 4.2.3 incorrectly parse component language strings as HTML instead of plain text. An attacker who controls the Dashboards language c...

CVE-2026-118252: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing...

PT-2026-129121

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the...

Highcharts cross-site scripting vulnerability

Versions prior to Highcharts 13.0.0-beta.2, as well as versions 2.0.0 through 3.2.0 for @highcharts/grid-lite and versions 2.0.0 through 3.2.0 for @highcharts/grid-pro, contain a cross-site scripting vulnerability. This vulnerability arises because Highcharts Grid writes pagination language strin...

CVE-2026-118254: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the...

TrueOnline / ZyXEL P660HN-T v1 Router Unauthenticated Command Injection Exploit

TrueOnline is a major ISP in Thailand, and it distributes a customised version of the ZyXEL P660HN-T v1 router. This customised version has an unauthenticated command injection vulnerability in the remote log forwarding page. This Metasploit module was tested in an emulated environment, as the...

TrueOnline / Billion 5200W-T Router Unauthenticated Command Injection Exploit

TrueOnline is a major ISP in Thailand, and it distributes a customized version of the Billion 5200W-T router. This customized version has at least two command injection vulnerabilities, one authenticated and one unauthenticated, on different firmware versions. This Metasploit module will attempt ...

TrueOnline / ZyXEL P660HN-T v1 Router Unauthenticated Command Injection

TrueOnline is a major ISP in Thailand, and it distributes a customized version of the ZyXEL P660HN-T v1 router. This customized version has an unauthenticated command injection vulnerability in the remote log forwarding page. This module was tested in an emulated environment, as the author doesn'...