CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-19744

CVE-2026-19744 details a stored Cross-site Scripting (XSS) vulnerability in the Markdown renderer of Pentestify (MaAlfer) prior to version 2.3.2. The issue arises when a Markdown link URL contains a double quote, which closes the anchor href and allows arbitrary JavaScript execution in the applic...

CVE-2026-19744: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

PT-2026-71684

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

CVE-2026-73237

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73237

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73237 Apache Allura: XSS in markdown pipeline

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73237

An XSS vulnerability exists in the Markdown handling pipeline of Apache Allura . This flaw affects versions from 1.10.0 before 1.19.1 . The vulnerability allows for the improper neutralization of script-related HTML tags in a web page. To remediate this issue, users are recommended to upgrade to ...

EUVD-2026-57344

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73237 Apache Allura: XSS in markdown pipeline

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-73237: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

PT-2026-71175

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-69116

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem...

CVE-2026-44401

Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdo...

CVE-2026-69116

CVE-2026-69116 affects FlyEnv prior to 4.18.0. The issue arises because HTML is not sanitized when rendering Markdown and AI chat content in Vue v-html directives, enabling attackers to inject malicious scripts that run in the Electron renderer with access to Node.js APIs and the filesystem. This...

CVE-2026-69116 FlyEnv < 4.18.0 Cross-Site Scripting via v-html

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem...

CVE-2026-69116 FlyEnv < 4.18.0 Cross-Site Scripting via v-html

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem...

CVE-2026-44401 Typemill CMS 2.x Persistent XSS via Markdown javascript URI

Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdo...

CVE-2026-44401

Typemill CMS 2.x contains a persistent XSS in the Markdown parser extension. Authenticated users with theme-configuration access can inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. The attack leverages javascript: schemes via ParsedownExtension.php or Twig...

CVE-2026-44401

Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdo...