CVE-2019-25225

sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting XSS. The sanitizeHtml function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed...

UBUNTU-CVE-2019-25225

sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting XSS. The sanitizeHtml function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed...

CVE-2014-125128

CVE-2014-125128 affects the sanitize-html library prior to 1.0.3. The root cause is the naughtyHref function not properly validating the href attribute in tags, allowing bypasses that rely on different casings, whitespace, or hexadecimal encodings. This leads to cross-site scripting (XSS) impact...

CVE-2014-125128

'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting XSS. The function 'naughtyHref' doesn't properly validate the hyperreference href attribute in anchor tags , allowing bypasses that contain different casings, whitespace characters, or hexadecimal encodings...

CVE-2014-125128

'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting XSS. The function 'naughtyHref' doesn't properly validate the hyperreference href attribute in anchor tags , allowing bypasses that contain different casings, whitespace characters, or hexadecimal encodings...

CVE-2019-25225

sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting XSS. The sanitizeHtml function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed...

CVE-2019-25225

sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting XSS. The sanitizeHtml function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed...

CVE-2019-25225

sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting XSS. The sanitizeHtml function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. As a result, malicious input can be transformed...

CVE-2019-25225

The CVE-2019-25225 entry has concrete details in connected documents: sanitize-html (pre-2.0.0-beta) is vulnerable to XSS when using the custom transformTags option. The vulnerability originates in sanitizeHtml() in index.js, which does not sanitize content under transformTags, allowing transform...

Apostrophe sanitize-html 安全漏洞

Apostrophe sanitize-html is a library from Apostrophe USA. It cleans up user-submitted HTML, keeping whitelisted elements and whitelisted attributes on a per-element basis. A security vulnerability exists in Apostrophe sanitize-html prior to version 2.0.0-beta, which stems from the sanitizeHtml...

PT-2025-36454

Name of the Vulnerable Software and Affected Versions: sanitize-html versions prior to 1.0.3 Description: The 'sanitize-html' software prior to version 1.0.3 is susceptible to Cross-site Scripting XSS. The naughtyHref function inadequately validates the href attribute within anchor tags , enablin...

PT-2025-36452

Name of the Vulnerable Software and Affected Versions: sanitize-html versions prior to 2.0.0-beta Description: The sanitizeHtml function in index.js does not sanitize content when using the custom transformTags option, which is intended to convert attribute values into text. This allows malicious...

Apostrophe sanitize-html 安全漏洞

Apostrophe sanitize-html is a library from Apostrophe USA. It cleans up user-submitted HTML, keeping whitelisted elements and whitelisted attributes on a per-element basis. A security vulnerability exists in Apostrophe sanitize-html versions prior to 1.0.3 that stems from the naughtyHref function...

Linux Distros Unpatched Vulnerability : CVE-2024-34000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk. CVE-2024-34000 Note that Nessus relies on the...

Permissive Regular Expression

Overview @mathharo/promptcraft-sanitize is a Sanitizer fix for overlapping multi-token patterns. Affected versions of this package are vulnerable to Permissive Regular Expression due to insufficient replacement of multi-character tokens. An attacker can execute arbitrary scripts in the context of...

nvme-tcp: sanitize request list handling

...

Output of "go env" does not sanitize values in cmd/go

...

PT-2025-35911

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: A stored authenticated cross-site scripting XSS issue exists due to insufficient validation of user-supplied data. The vulnerability is present in the /apprain/developer/language/lipsum.xml endpoint...

PT-2025-35458

Name of the Vulnerable Software and Affected Versions: itsourcecode Sports Management System version 1.0 Description: A flaw exists in itsourcecode Sports Management System version 1.0, specifically within an unknown function of the file /Admin/resultdetails.php. Manipulation of the ID argument c...

Linux Distros Unpatched Vulnerability : CVE-2021-23648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting XSS due to improper sanitization in sanitizeUrl function. CVE-2021-23648...