CVE-2025-70060

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0...

PT-2026-24080

Name of the Vulnerable Software and Affected Versions YMFE yapi version 1.12.0 Description An issue exists due to improper neutralization of input during web page generation. This allows for potential cross-site scripting XSS attacks. The issue is related to CWE-79. Recommendations At the moment,...

CVE-2025-70033

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4...

CVE-2025-70060

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0...

CVE-2025-70039

An issue pertaining to CWE-78: Improper Neutralization of Special Elements used in an OS Command was discovered in linagora Twake v2023.Q1.1223...

CVE-2025-70038

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in linagora Twake v2023.Q1.1223. This allows attackers to execute arbitrary code...

CVE-2025-70033

A security vulnerability exists in Sunbird-Ed SunbirdEd-portal v1.13.4 due to CWE-79: Improper Neutralization of Input During Web Page Generation . This flaw can potentially lead to cross-site scripting (XSS) attacks. Exploitation details and specific remediation instructions are not provided in ...

CVE-2025-70038

A security vulnerability was identified in linagora Twake v2023.Q1.1223 involving CWE-79: Improper Neutralization of Input During Web Page Generation . This flaw allows attackers to execute arbitrary code and is specifically identified as a Cross-Site Scripting (XSS) issue. No information regardi...

CVE-2025-70039

An issue pertaining to CWE-78: Improper Neutralization of Special Elements used in an OS Command was discovered in linagora Twake v2023.Q1.1223...

CVE-2025-70060

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0...

PT-2026-24096

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4...

CVE-2025-70039

An issue pertaining to CWE-78: Improper Neutralization of Special Elements used in an OS Command was discovered in linagora Twake v2023.Q1.1223...

CVE-2025-70039

The linagora Twake collaboration platform version v2023.Q1.1223 is affected by a vulnerability involving CWE-78: Improper Neutralization of Special Elements used in an OS Command . This issue stems from the improper handling of special elements when executing OS commands. While the impact is cate...

CVE-2025-70038

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in linagora Twake v2023.Q1.1223. This allows attackers to execute arbitrary code...

PT-2026-24088

An issue pertaining to CWE-78: Improper Neutralization of Special Elements used in an OS Command was discovered in linagora Twake v2023.Q1.1223...

PT-2026-24087

Name of the Vulnerable Software and Affected Versions linagora Twake version 2023.Q1.1223 Description An issue exists due to improper neutralization of input during web page generation, which allows attackers to execute arbitrary code. This is a Cross-Site Scripting XSS issue. Recommendations At...

CVE-2025-70038

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in linagora Twake v2023.Q1.1223. This allows attackers to execute arbitrary code...

CVE-2025-70033

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4...

CVE-2025-70060

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0...

CVE-2026-30830: Improper Neutralization of Input During Web Page Generation

Defuddle cleans up HTML pages. Prior to version 0.9.0, the findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event...