xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

Summary An embedded line terminator bypasses the requireWellFormed serializer check for a DocumentType's publicId and systemId. The check was added to fix GHSA-f6ww-3ggp-fr8h; an id whose first line is a valid literal slips past it and is emitted verbatim into the declaration, so the markup after...

GHSA-VR34-HP96-76PP xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

Summary An embedded line terminator bypasses the requireWellFormed serializer check for a DocumentType's publicId and systemId. The check was added to fix GHSA-f6ww-3ggp-fr8h; an id whose first line is a valid literal slips past it and is emitted verbatim into the declaration, so the markup after...

CVE-2026-83618 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by...

CVE-2026-83618

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by...

PT-2026-34617

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions prior to 0.6.0 Description The package serializes DocumentType node fields internalSubset, publicId, and systemId verbatim without escaping or...

CVE-2018-7180

SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter...

CVE-2018-7177

SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter...

CVE-2018-7178

SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter...

Sql injection

SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter...

Sql injection

SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter...

CVE-2018-7177

SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter...

CVE-2018-7180

SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter...

CVE-2018-7178

SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter...

PT-2018-17933

Name of the Vulnerable Software and Affected Versions Saxum Numerology version 3.0.4 Description A SQL Injection issue exists in the Saxum Numerology component for Joomla!, which can be exploited via the publicid parameter. Recommendations For Saxum Numerology version 3.0.4, avoid using the...

CVE-2018-7178: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter...

CVE-2018-7180: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter...

PT-2018-17934

Name of the Vulnerable Software and Affected Versions Saxum Picker version 3.2.10 Description A SQL Injection issue exists in the Saxum Picker component for Joomla!, which can be exploited via the publicid parameter. Recommendations For Saxum Picker version 3.2.10, update to a newer version that...

PT-2018-17936

Name of the Vulnerable Software and Affected Versions Saxum Astro version 4.0.14 Description A SQL Injection issue exists in the Saxum Astro component for Joomla!, which can be exploited via the publicid parameter. Recommendations For Saxum Astro version 4.0.14, avoid using the publicid parameter...

CVE-2018-7177: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter...