PT-2026-34815

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.0 Kirby versions prior to 5.4.0 Description The Xml::value method in Kirby contains a flaw in how it handles blocks. While the method is designed to allow valid CDATA to pass through without being escaped a second...

PT-2026-8392

Impact During a security audit conducted with Claude Opus 4.6 and GPT-5.3-Codex, we identified three specific ways to bypass the XSS cross-site-scripting protection built into Phlex. 1. The first bypass could happen if user-provided attributes with string keys were splatted into HTML tag, e.g...

Badaso 跨站脚本漏洞

Badaso is an open source Laravel Vue headless CMS from Uasoft. A security vulnerability exists in Badaso v2.9.7, which originates from the execution of arbitrary web script or HTML via the Title parameter in the Add Tag method...