15 matches found
CVE-2026-117645
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...
CVE-2026-117645
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...
CVE-2026-117645
The phoenix_html component of the phoenixframework is vulnerable to Cross-site Scripting (XSS) via attribute injection. The root cause is that attributes_escape/1 fails to validate or escape attribute names; specifically, key_escape/1 only neutralizes quotes and angle brackets but allows whitespa...
EUVD-2026-114454
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...
CVE-2026-117645 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...
EEF-CVE-2026-117645 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Summary Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...
CVE-2026-117645 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...
CVE-2026-117645: phoenixframework phoenix_html: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework…
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...
EUVD-2023-0339
Malicious code in bioql PyPI...
Cross-site Scripting (XSS)
phoenixhtml is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters before it outputs to the front end, allowing an attacker to inject and execute malicious JavaScript via HEEx class attributes in tag.ex...
GHSA-5G2H-9X5V-5H3X phoenix_html allows Cross-site Scripting in HEEx class attributes
tag.ex in Phoenix Phoenix.HTML aka phoenixhtml before 3.0.4 allows XSS in HEEx class attributes...
CVE-2021-46871: Improper Neutralization of Input During Web Page Generation
tag.ex in Phoenix Phoenix.HTML aka phoenixhtml before 3.0.4 allows XSS in HEEx class attributes...
CVE-2021-46871
tag.ex in Phoenix Phoenix.HTML aka phoenixhtml before 3.0.4 allows XSS in HEEx class attributes...
@makerdao/testchain-client (>=0.0.1, <=0.3.0-beta.0) potentially affected by CVE-2021-46871 via phoenix_html (2.14.3)
phoenixhtml NPM version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on phoenixhtml and may be impacted: - @makerdao/testchain-client =0.0.1, =0.3.0-beta.0 Source cves: CVE-2021-46871 Source advisory: MEND:CVE-2021-46871...