27 matches found
EUVD-2026-92133
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...
CVE-2026-105220
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...
CVE-2026-105220
A flaw was found in Twine. The application fails to properly sanitize markup during story import, allowing embedded malicious scripts to execute within the editor interface. By convincing a user to import a specially crafted story file, an attacker can leverage an internal inter-process...
CVE-2026-105220 Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...
CVE-2026-105220
Twine 2 Desktop (versions through 2.12.0 ) is vulnerable to Arbitrary Code Execution due to a cross-site scripting (XSS) flaw in the importStories() function. The root cause is a failure to properly sanitize markup during the import of story files, which allows malicious scripts to execute within...
CVE-2026-105220 Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...
CVE-2026-105220 Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...
CVE-2026-105220: Improper Neutralization of Input During Web Page Generation
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...
PT-2026-104654
Name of the Vulnerable Software and Affected Versions Twine 2 desktop versions prior to 2.12.1 Description A cross-site scripting issue exists in the importStories function that allows the execution of markup from imported story files within the editor window. An attacker can create a malicious...
CVE-2026-11956 TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute
A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cookie Handler. Executing a manipulation can lead to sensitive cookie without secure attribute. The attack can be launched remotely. This attac...
llvm:llvm-isel-fuzzer--mips64-O2: Stack-use-after-scope in llvm::Twine::print
Detailed Report: https://oss-fuzz.com/testcase?key=5214389677654016 Project: llvm Fuzzing Engine: honggfuzz Fuzz Target: llvm-isel-fuzzer--mips64-O2 Job Type: honggfuzzasanllvm Platform Id: linux Crash Type: Stack-use-after-scope READ 8 Crash Address: 0x7bfff6514560 Crash State: llvm::Twine::prin...
EUVD-2024-50920
Malicious code in bioql PyPI...
Malicious code in twine-to-yoto (npm)
The package twine-to-yoto was found to contain malicious code...
Malicious code in twine-rails (npm)
The package twine-rails was found to contain malicious code...
MAL-2025-37378 Malicious code in twine-to-yoto (npm)
The package twine-to-yoto was found to contain malicious code...
MAL-2025-37377 Malicious code in twine-rails (npm)
The package twine-rails was found to contain malicious code...
CVE-2024-12509
The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedtwine' shortcode in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-12509 Embed Twine <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedtwine' shortcode in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-12509 Embed Twine <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedtwine' shortcode in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-12509
CVE-2024-12509 – Embed Twine (WordPress) : The WordPress Embed Twine plugin (versions up to 0.1.0) is vulnerable to a Stored Cross-Site Scripting (XSS) via the plugin’s embed_twine shortcode. The root cause is insufficient input sanitization and output escaping on user-provided attributes, enabli...