141918 matches found
CVE-2026-8630
justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...
CVE-2026-7808
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...
CVE-2026-8630 justhtml before 1.12.0 Mutation XSS via Raw Text Elements
justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...
CVE-2026-8630
justhtml versions ≤ 1.11.0 contain a mutation XSS (mXSS) vulnerability in the serialization of raw-text elements (, [removed]). When sanitize_dom() is invoked with a custom policy that retains these elements, text nodes inside them are serialized without escaping, allowing an attacker to inject a...
EUVD-2026-64660
justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...
EUVD-2026-64658
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...
CVE-2026-7808 justhtml before 1.16.0 Multiple Security Issues via Sanitization
justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...
CVE-2026-7808
justhtml (Python HTML parsing library) before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active content such as [removed] or to survive sanitization, potentially leading to cross-site scripting . The issues primarily affect advanced usage rather than the default Just...
Malicious code in 10-shardsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7da64238cd4a48de7b5df200b6b36734be8e33dbc21e3f34a17c7235c94555 index.js is a top-level async IIFE that fetches HTML from the hardcoded, unpinned URL...
MAL-2026-14362 Malicious code in 10-shardsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7da64238cd4a48de7b5df200b6b36734be8e33dbc21e3f34a17c7235c94555 index.js is a top-level async IIFE that fetches HTML from the hardcoded, unpinned URL...
Malicious code in 2-loadsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae23fe6221515577f9b639185cc745675d9711daad4da9fd6d5851aa27c08b5 The package consists of a minimal HTML wrapper index.html whose only behavior is to fetch content from a hardcoded, unpinned URL at...
MAL-2026-14363 Malicious code in 2-loadsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae23fe6221515577f9b639185cc745675d9711daad4da9fd6d5851aa27c08b5 The package consists of a minimal HTML wrapper index.html whose only behavior is to fetch content from a hardcoded, unpinned URL at...
Malicious code in 3-buildsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed2d8b62e8d6f475efc170e1f26783037acc358eac7f32153110f29ecb415545 The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket raw URL,...
MAL-2026-14364 Malicious code in 3-buildsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed2d8b62e8d6f475efc170e1f26783037acc358eac7f32153110f29ecb415545 The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket raw URL,...
MAL-2026-14366 Malicious code in 8-fetchsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0e6a4c6ee9a60609bc1a9e9f1eccfa2166aaf106ba50c35d51aac34ecb3f549 index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, parses the respons...
Malicious code in 8-fetchsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0e6a4c6ee9a60609bc1a9e9f1eccfa2166aaf106ba50c35d51aac34ecb3f549 index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, parses the respons...
M3200-OpenUI
Inseego M3200 Root Exploit A single-file exploit that takes t...
WordPress Qubely < 1.8.6 - Unauthenticated Email Sending
Qubely WordPress plugin 1.8.6 contains an insecure deserialization caused by unauthenticated users being able to send arbitrary emails via the qubelysendformdata AJAX action, letting attackers send spam or malicious emails, exploit requires no authentication. id: CVE-2021-24916 info: name:...
Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. i...
Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)
cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. id: CVE-2022-38840 info: name: Güralp MAN-EAM-0003 3.2.4 - XML External Entity XXE author: daffainfo severity: high description: |...