23 matches found
CVE-2026-97723
madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...
EUVD-2026-86499
madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...
CVE-2026-97723
madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...
CVE-2026-97723
The madpsy ka9q_ubersdr software, in versions before 0.1.58 , is susceptible to a stored cross-site scripting (XSS) vulnerability within the chat message rendering functionality. The root cause is the insufficient neutralization of user-controlled URLs before they are converted into HTML links. S...
CVE-2026-97723
madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...
CVE-2026-97723
madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...
CVE-2026-97723: Improper Neutralization of Input During Web Page Generation
madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...
PYSEC-2026-3650 Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...
Cross-site Scripting (XSS)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS via the KatexRenderer process in the message rendering component. An attacker can execute arbitrary scripts in the browser of any user who views a crafted message by embedding malicio...
Exploit for CVE-2026-29971
CVE-2026-29971 An attacker can execute arbitrary JavaScript in...
Cross-site Scripting (XSS)
Overview sylius/sylius is a platform for PHP, based on Symfony framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the ApiLoginController process. An attacker can execute arbitrary JavaScript in the context of the user's browser by injecting malicious conten...
Sylius 跨站脚本漏洞
Sylius is an open-source e-commerce platform developed by the Polish company Sylius, based on the Symfony framework. Sylius has a cross-site scripting vulnerability. This vulnerability arises from the use of the innerHTML method to render the message field in the login form during checkout, which...
EUVD-2024-45527
Malicious code in bioql PyPI...
Reflected Cross-Site Scripting (Reflected XSS)
silverstripe/framework is vulnerable to Reflected Cross-Site Scripting Reflected XSS. The vulnerability is due to the "dev" environment mode improperly rendering error messages, allowing an attacker to execute XSS payloads by providing a malicious URL...
FreeBSD : element-web -- several vulnerabilities (ab4e6f65-a142-11ef-84e9-901b0e9408dc)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ab4e6f65-a142-11ef-84e9-901b0e9408dc advisory. Element team reports: Versions of Element Web and Desktop earlier than 1.11.85 do not check if...
CVE-2024-51750
CVE-2024-51750 affects Element Web/Desktop prior to version 1.11.85. A malicious homeserver can send invalid messages over federation, which can prevent rendering of single messages or the entire room containing them. The issue is documented across multiple feeds, with remediation implemented in ...
laminas-form 跨站脚本漏洞
laminas-form is an open source library , mainly used as a bridge between the domain model and the view layer . It consists of a thin object layer representing form elements, an InputFilter, and a handful of methods for binding data to the form and attaching objects. A security vulnerability exist...
