CVE-2026-31873

Unhead suffers a bypass of URI scheme sanitization in makeTagSafe prior to version 2.1.11: the code checks href values with String.includes(), which is case-sensitive. Since browsers treat URI schemes case-insensitively, inputs like DATA:text/css,... can evade the check and allow arbitrary CSS vi...

CVE-2026-31873 Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe safe.ts uses String.includes, which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes'data...

EUVD-2021-2086

Malware in sbrugna...

EUVD-2023-1682

Malicious code in bioql PyPI...

CVE-2019-14671

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fintsurl to import/job/configuration, and import/create/fints...

Improper Input Validation in Firefly III

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fintsurl to import/job/configuration, and import/create/fints...

Cross-site Scripting (XSS) - Stored in thoughtbot/administrate

💥 BUG Stored xss using unsanitize url 💥 IMPACT There is no url scheme sanitization, allow to provide javascript protocol in url which cause xss 💥 PAYLOAD javascript:alertdocument.domain 💥 STEP TO REPRODUCE tested in demo version https://administrate-demo.herokuapp.com/admin.\ 1. Plz check this 1...

CVE-2019-14671

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fintsurl to import/job/configuration, and import/create/fints...

Design/Logic Flaw

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fintsurl to import/job/configuration, and import/create/fints...