CVE-2023-2859

CVE-2023-2859: TeamPass 3.0.9 में व्यवस्थापक Admin को प्रभावित करने वाला folderName में संग्रहीत HTML इंजेक्शन - M Nadeem Qazi नमस्ते, मुझे nilsteampassnet/teampass एप्लिकेशन में एक गंभीर भेद्यता मिली है जिसमें FolderName फ़ील्ड में संग्रहीत HTML इंजेक्शन stored HTML injection शामिल है। FolderNam...

CVE-2023-2591

CVE-2023-2591: Teampass 3.0.6 में आइटम लेबल में संग्रहीत HTML इंजेक्शन - M Nadeem Qazi हाल ही में मैंने nilsteampassnet/teampass, एक लोकप्रिय पासवर्ड प्रबंधन उपकरण, में एक सुरक्षा भेद्यता की पहचान की। यह भेद्यता, जिसे CVE-2023-2591 के रूप में पहचाना गया है, आइटम लेबल फ़ील्ड में एक संग्रहीत HTML...

CVE-2025-55903

CVE-2025-55903 : Injection HTML stockée dans PerfexCRM ⚠️ Avis de sécurité Une vulnérabilité critique d'injection HTML stockée affectant les factures, la facturation et les communications automatisées -ff6600 📋 Vue d'ensemble Une vulnérabilité d'injection HTML stockée a été découverte dans...

CVE-2025-60378

CVE-2025-60378 : Injection HTML stockée dans RISE Ultimate Project Manager & CRM ⚠️ Avis de sécurité Une vulnérabilité critique d'injection HTML stockée affectant les factures, la messagerie et les communications automatisées -ff6600 📋 Vue d'ensemble Une vulnérabilité critique d'injection HTML...

CVE-2026-33657

CVE-2026-33657 - حقن HTML مخزّن في إشعارات البريد الإلكتروني في EspoCRM 9.3.3 إثبات مفهوم موثّق لحقن HTML مخزّن في إشعارات البريد الإلكتروني في EspoCRM 9.3.3. الملخص يقوم EspoCRM 9.3.3 بعرض رسائل البريد الإلكتروني الخاصة بإشعارات تدفق النشاط stream-note عن طريق تحويل نص الملاحظة باستخدام Markdown...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 قبل الإصدار 11.3.757 عرضة لحقن HTML مخزّن في لوحة إدارة CrushFTP التقارير / "Who Created Folder"، مما يتيح تنفيذ HTML مستمر في جلسات الإدارة. CWE CWE-79 — التعطيل غير الصحيح للإدخال أثناء توليد صفحة الويب Cross-site Scripting CVSS v3.1 النتيجة الأساسية: 4.1 متوسط...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 قبل الإصدار 11.3.757 عرضة لحقن HTML مخزّن في لوحة إدارة CrushFTP التقارير / "Who Created Folder"، مما يتيح تنفيذ HTML مستمرًا في جلسات المسؤولين. CWE CWE-79 — عدم التحييد السليم للمدخلات أثناء توليد صفحة الويب البرمجة النصية عبر المواقع الدرجة الأساسية CVSS v3.1: 4.1...

CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

GHSA-H58C-XCCX-75M3 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...

CVE-2026-31981

A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data through multiple inpu...

CVE-2026-55437 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded...

CVE-2026-55437 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded...

CVE-2026-45106

Weblate (web-based localization tool) is affected by a stored HTML injection/XSS in the live search preview prior to version 2026.5, where unit source and context are rendered without escaping, allowing HTML/CSS that runs in authenticated editors of other users performing a matching search. The i...

CVE-2025-40901

A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious identity containing HTML tags. When a victim attempts to delete the affected...

CVE-2025-40903

A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious restore schedule containing HTML tags. When a victim views the affected...

CVE-2025-40904

A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privileges can push malicious remote strategies containing HTML tags through the sync. When a victim views the affected remo...

CVE-2025-40902

A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can create a malicious user whose username contains HTML tags. When a victim attempts to delete a group containing...

CVE-2026-33657

EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard non-administrative privileges to inject arbitrary HTML into system-generated email notifications by crafting...

CVE-2026-42401

Improper Neutralization of Input During Web Page Generation CWE-79 in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently...

EUVD-2026-33012

Improper Neutralization of Input During Web Page Generation CWE-79 in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently...