CVE-2026-34212

CVE-2026-34212 Docmost 接受了一个包含 javascript: URL 的附件节点，将其原样存储并通过渲染后，在 Docmost 源域中将其恢复为可点击的锚点。 简介 我识别、负责任地披露并复现了 Docmost （一个开源协作文档平台）中的一个高风险存储型 XSS 问题。 Docmost 官方站点将其定位为企业级本地部署 Wiki，拥有 3M+ 下载量 ，并声称被包括 维尔纽斯市政府 、Bechtle 、澳大利亚政府 、红十字会 和 ETS Quebec 在内的组织团队所信赖。 该漏洞位于富文本系统中一个容易被忽视的地方：...

CVE-2019-12836

CVE-2019-12836 应用 JEditor v3.0.5 - JIRA 的所见即所得编辑器 适用于 Jira 的简单而强大的富文本编辑器。可导入 HTML 邮件、粘贴富内容、创建模板并预填充字段。 产品供应商 Bobronix 供应商网站 http://bobronix.com/ CVE 参考 https://vulners.com/cve/CVE-2019-12836 受影响的产品代码库 JEditor - Jira 的所见即所得编辑器 - v3.0.5 受影响组件 JEditor v3.0.5 描述 Jira 使用的 Bobronix JEditor 编辑器（v3.0.6...

[SECURITY] Fedora 45 Update: xed-3.9.0-2.fc45

Xed is a small, but powerful text editor. It has most standard text editor functions and fully supports international text in Unicode. Advanced features include syntax highlighting and automatic indentation of source code, printing and editing of multiple documents in one window. Xed is extensibl...

[SECURITY] Fedora 45 Update: pluma-1.28.1-4.fc45

pluma is a small, but powerful text editor designed specifically for the MATE desktop. It has most standard text editor functions and fully supports international text in Unicode. Advanced features include syntax highlighting and automatic indentation of source code, printing and editing of...

CVE-2026-90438

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...

[SECURITY] Fedora 45 Update: gnome-text-editor-51.0-1.fc45

GNOME Text Editor is a simple text editor that focuses on session management. It works hard to keep track of changes and state even if you quit the applica tion. You can come back to your work even if you've never saved it to a file...

CVE-2026-96326

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-88602

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96326

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin, for versions up to and including 2.10.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the Rich Text Editor Field . This allows unauthenticated...

CVE-2026-96326 HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96326 HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-102430

Name of the Vulnerable Software and Affected Versions HT Contact Form – Drag & Drop Form Builder for WordPress versions prior to 2.10.3 Description Insufficient input sanitization and output escaping in the Rich Text Editor Field allow unauthenticated attackers to perform Stored Cross-Site...

CVE-2026-96326: Improper Neutralization of Input During Web Page Generation

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-86390

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute...

CVE-2026-61823

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-61823

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the "srcdoc" attribute on iframe elements. Although markup...

CVE-2026-61823

The code16 Sharp framework (a Laravel-based CMS/admin interface) is vulnerable to stored cross-site scripting (XSS) in versions prior to 9.22.5 . The root cause is that the rich-text editor's HTML sanitizer allows the srcdoc attribute on iframe elements. While the sanitizer HTML-encodes the inter...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...