#cwe-116

共收录 223 条相关情报。

漏洞预警2026-09-16 发布INFO

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of a...

CVE-2026-13407

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted throu

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-09-15 发布INFO

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation o...

CVE-2026-19641

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can creat

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-09-10 发布INFO

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angula...

CVE-2026-88060

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

漏洞预警2026-09-10 发布INFO

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angula...

CVE-2026-88058

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

安全公告2026-09-10 发布INFO

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

CVE-2026-88060

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-116 #cwe-79

安全公告2026-09-10 发布INFO

Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

CVE-2026-88058

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-116 #cwe-79

漏洞预警2026-09-10 发布INFO

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objects, and...

CVE-2026-88921

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for re

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

安全公告2026-09-10 发布INFO

MISP: Unescaped HTML Injection in PDF Report Element Rendering

CVE-2026-88921

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for re

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-116 #cwe-79

漏洞预警2026-09-09 发布INFO

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct explo...

CVE-2026-54694

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a s

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-79 #cwe-116 #cwe-183 #cwe-693

安全公告2026-09-09 发布INFO

NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

CVE-2026-54694

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a s

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-116 #cwe-183 #cwe-20 #cwe-693 #cwe-79

漏洞预警2026-09-07 发布INFO

Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication param...

CVE-2026-82756

Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthen

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

漏洞预警2026-09-05 发布MEDIUM

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body cont...

CVE-2026-52772

YesWiki是一个基于PHP的开源wiki系统，用于团队协同编辑与知识管理。在4.6.6版本之前，其Bazar表单字段模板在处理字段标签（field.label）和字段提示（field.hint）时，错误地继续使用`|raw('html'

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-116

漏洞预警2026-09-02 发布INFO

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated ...

CVE-2026-84292

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

安全公告2026-09-02 发布INFO

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-116 #severity:medium

漏洞预警2026-09-02 发布INFO

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control ...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

安全公告2026-09-02 发布INFO

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

CVE-2026-83610

## Summary An `EntityReference` node can be created with an invalid, attacker-controlled name through `Document.createE

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-116 #severity:medium

漏洞预警2026-09-02 发布INFO

In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g...

CVE-2026-82958

In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a Cr

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-116 #cwe-1336

安全公告2026-09-02 发布INFO

CVE-2026-82958

In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a Cr

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-116 #cwe-1336 #cwe-74

漏洞预警2026-09-01 发布INFO

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versi...

CVE-2026-83610

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld

历史摘要 · 未重新核验 · NVD

#cve #cwe-116

安全公告2026-09-01 发布INFO

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

CVE-2026-83610

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-116