CVE-2026-59727

CVE-2026-59727 (Astro): In versions 3.10.0–7.0.3, unescaped values copied from transition:persist, transition:scope, or transition:persist-props into the rendered element enable reflected XSS if an attacker-controlled input is reflected into these directives. The issue arises when untrusted inpu...

CVE-2026-59727 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without...

CVE-2026-59727 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without...

CVE-2026-59729

CVE-2026-59729 affects Astro versions prior to 7.0.6, where unescaped spread attribute names in renderHTMLElement can lead to XSS in SSR when rendering a native HTMLElement-subclass component. The root cause is an inline attribute loop in renderHTMLElement that interpolates attribute names withou...

CVE-2026-59729 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 GHSA-jrpj-wcv7-9fh9 added an INVALIDATTRNAMECHAR guard to addAttribute so that spread-prop attribute names...

EUVD-2026-49580

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 GHSA-jrpj-wcv7-9fh9 added an INVALIDATTRNAMECHAR guard to addAttribute so that spread-prop attribute names...

CVE-2026-66031

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66029

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

CVE-2026-59239

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

EUVD-2026-49397

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66031 Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66031

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66031 Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66031

The vulnerability CVE-2026-66031 affects Ekushey Project Manager CRM version 5.0. It is a stored cross-site scripting (XSS) flaw triggered by malicious payloads entered into the Reply Ticket field, executable in the browser sessions of Staff or Administrator users when they view the Support Ticke...

CVE-2026-66030 Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and...

CVE-2026-66030

CVE-2026-66030: Ekushey Project Manager CRM (version up to 5.0) contains a stored XSS vulnerability. Authenticated client users can inject HTML/JavaScript into the Ticket Title field on the Create New Ticket page; crafted scripts are stored and may execute in browser sessions of Staff or Administ...

EUVD-2026-49393

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

CVE-2026-66029 Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

CVE-2026-66029

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

CVE-2026-66029

CVE-2026-66029 affects Ekushey Project Manager CRM up to version 5.0. A stored cross-site scripting (XSS) vulnerability exists in the client management flow: authenticated client users can inject arbitrary HTML/JavaScript by entering payloads into the client Name field on the Edit Profile page, w...