xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

Summary An embedded line terminator bypasses the requireWellFormed serializer check for a DocumentType's publicId and systemId. The check was added to fix GHSA-f6ww-3ggp-fr8h; an id whose first line is a valid literal slips past it and is emitted verbatim into the declaration, so the markup after...

CVE-2026-83618

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by...

CVE-2026-83618 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by...

PT-2026-34617

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions prior to 0.6.0 Description The package serializes DocumentType node fields internalSubset, publicId, and systemId verbatim without escaping or...

CVE-2018-7180

SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter...

CVE-2018-7177

SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter...

CVE-2018-7178

SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter...

Sql injection

SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter...

Sql injection

SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter...

CVE-2018-7178

SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter...

CVE-2018-7180

SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter...

CVE-2018-7177

SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter...