CVE-2024-28149

CVE-2024-28149 affects the Jenkins HTML Publisher Plugin, versions 1.16 through 1.32 . The root cause is improper input sanitization, enabling attackers with Item/Configure permission to perform cross-site scripting (XSS) and to determine whether a path on the Jenkins controller filesystem exists...

CVE-2019-10432

Summary (CVE-2019-10432): Jenkins HTML Publisher Plugin (versions

CVE-2024-28150

CVE-2024-28150 affects Jenkins HTML Publisher Plugin, version 1.32 and earlier. The issue is a stored XSS vulnerability caused by the plugin failing to escape job names, report names, and index page titles shown within the report frame. Exploitation requires attackers to have Item/Configure permi...

CVE-2024-28151

Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, enabling attackers with Item/Configure permission to determine whether a path on the Jenkins controller filesystem exists without accessing it. Affe...

CVE-2018-1000175

Jenkins HTML Publisher Plugin

CVE-2025-53651

CVE-2025-53651 affects the Jenkins HTML Publisher Plugin, 425 and earlier. The issue arises because log messages include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller filesystem in build logs. The Connected ...

CVE-2026-42524

CVE-2026-42524 : Jenkins HTML Publisher Plugin 427 and earlier is vulnerable to a stored XSS due to not escaping the job name and URL in the legacy wrapper file. This can be exploited by attackers with Item/Configure permission. The public descriptions identify the affected component and the root...