CVE-2024-28149

The Jenkins HTML Publisher Plugin versions 1.16 through 1.32 (inclusive) contains a flaw where the fallback for reports created in version 1.15 and earlier fails to properly sanitize input. This vulnerability allows attackers with Item/Configure permissions to perform stored cross-site scripting ...

CVE-2019-10432

Summary (CVE-2019-10432): Jenkins HTML Publisher Plugin (versions

CVE-2024-28150

The Jenkins HTML Publisher Plugin (version 1.32 and earlier ) is vulnerable to stored cross-site scripting (XSS) . The root cause is a lack of proper input sanitization and escaping for job names , report names , and index page titles displayed within the report frame. Specifically, the publishRe...

CVE-2024-28151

The Jenkins HTML Publisher Plugin (version 1.32 and earlier ) is vulnerable to a Path Traversal flaw. The root cause is the improper archiving of invalid symbolic links in report directories on agents and their subsequent recreation on the Jenkins controller. This oversight allows attackers with ...

CVE-2018-1000175

Jenkins HTML Publisher Plugin

CVE-2025-53651

The Jenkins HTML Publisher Plugin (version 425 and earlier ) is vulnerable to an information disclosure flaw in its publishReports functionality. The plugin displays log messages containing the absolute paths of files archived during the Publish HTML reports post-build step. This allows an attack...

CVE-2026-42524

The Jenkins HTML Publisher Plugin (versions 427 and earlier) is vulnerable to a stored cross-site scripting (XSS) attack because it fails to escape the job name and URL within the legacy wrapper file. Attackers with Item/Configure permissions can exploit this to execute malicious scripts. To reme...