21 matches found
CVE-2026-9390 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...
CVE-2026-47376
CVE-2026-47376 (NocoDB) describes a reflected XSS on the password-reset flow. Before 2026.04.1, the token from the password-reset URL was directly embedded into a JavaScript string in a server-rendered EJS template, which does not escape single quotes or backslashes. This allowed an attacker-cont...
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
Summary WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The cleantitle field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to...
EUVD-2018-0543
Malware in sbrugna...
Security Bulletin:Due to use of Dojo Toolkit before 1.14 in IBM Tivoli Network Manager is vulnerable to unescaped string injection in dojox/Grid/DataGrid(CVE-2018-15494)
Summary In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid. dojox/grid/Builder.js and dojox/grid/cells/base.js, providing the class dojox/Grid/DataGrid, are affected by CVE-2018-15494, an unescaped string injection vulnerability. Vulnerability Details CVEID:...
Security Bulletin: Vulnerability in Dojo Toolkit affecting Watson Knowledge Catalog for IBM Cloud Pak for Data
Summary Unescaped string injection in dojox/Grid/DataGrid is affecting some of the Watson Knowledge Catalog for IBM Cloud Pak for Data web UIs. Vulnerability Details CVEID: CVE-2018-15494 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of user-suppli...
Security Bulletin: Various security vulnerabilities in IBM Financial Transaction Manager for SWIFT Services
Summary Various security vulnerabilities in IBM Financial Transaction Manager for SWIFT Services could allow a remote attacker to gain access to unauthorized actions and data. Vulnerability Details CVEID: CVE-2018-15494 DESCRIPTION: In Dojo Toolkit before 1.14, there is unescaped string injection...
DEBIAN-CVE-2019-11025
In clearFilter in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string SNMP Options in the View poller cache, leading to XSS...
dojox vulnerable to unescaped string injection
In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid...
Cross-site Scripting (XSS)
primefaces-extensions is vulnerable to cross-site scripting XSS attacks. The library does not escape the string input when setting the menuItem label, allowing a malicious user to inject and execute arbitrary Javascript...
CVE-2018-15494
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid...
CVE-2018-15494
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid...
DEBIAN-CVE-2018-15494
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid...
CVE-2018-15494
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid...
CVE-2018-15494
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid...
CVE-2018-15494
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid...
CVE-2018-15494
CVE-2018-15494: Dojo Toolkit’s DataGrid in Dojo before 1.14 is vulnerable to unescaped string injection, enabling cross‑site scripting. Affected component is dojox/Grid/DataGrid; impact is client-side script execution in the context of the hosting page. The public fix is to upgrade to Dojo 1.14 o...
CVE-2018-3757
Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter...
