EUVD-2026-91853

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477: Improper Neutralization of Input During Web Page Generation

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477

The Showdown library (versions through 2.1.0 ) is vulnerable to Cross-Site Scripting (XSS) due to a flaw in the makehtml link and image subparsers. The root cause is the failure to properly sanitize or escape double quotes in destination URLs when rendering HTML attributes like href and src. A re...

CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

PT-2026-104459

Name of the Vulnerable Software and Affected Versions Showdown versions prior to 2.1.1 Description Cross-site scripting occurs in the makehtml link and image subparsers due to a failure to escape double quotes in destination URLs used within href and src attributes. This allows attackers to creat...

CVE-2026-59710: Improper Neutralization of Input During Web Page Generation

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...

CVE-2024-30855

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /src/dede/makehtmllistaction.php...

CVE-2024-30855

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /src/dede/makehtmllistaction.php...

CVE-2024-30855

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /src/dede/makehtmllistaction.php...

DesDev DedeCMS security vulnerability

DesDev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS from China's Zhuozhuo DesDev. The system features content publishing, content management, content editing and content retrieval. DesDev DedeCMS v5.7 version of a security vulnerability ...

CVE-2024-30855

The DedeCMS content management system, specifically version v5.7 , is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. The flaw exists within the /src/dede/makehtml_list_action.php endpoint, which could allow a malicious actor to trick a user into performing unintended actions on...

CVE-2024-30855

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /src/dede/makehtmllistaction.php...

PT-2025-53785

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 Description The software contains a Cross-Site Request Forgery CSRF issue. The vulnerability is located in the /src/dede/makehtml list action.php endpoint. A malicious actor can potentially cause a user to perform unintende...

CVE-2024-30855

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /src/dede/makehtmllistaction.php...

CVE-2024-33371

Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the makehtmllistaction.php component...

PT-2024-25219 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.113 Description: The issue allows a remote attacker to execute arbitrary code via the typeid parameter in the makehtml list action.php component. This is a Cross Site Scripting vulnerability. Recommendations: For DedeCMS...

CVE-2024-3148

A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112. This issue affects some unknown processing of the file dede/makehtmlarchivesaction.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public...

CVE-2024-3147

A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/makehtmlmap.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be...

CVE-2024-3145

A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/makehtmljsaction.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to...