NocoBase fails to sanitize rich text field values in the read renderer, allowing users with...
CVE-2026-84701
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store
#cwe-79
共收录 5519 条相关情报。
← 返回所有主题A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown...
CVE-2026-84437
A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/c
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of...
CVE-2026-84438
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/control
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing...
CVE-2026-84695
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accept
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workfl...
CVE-2026-84438
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/control
A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomple...
CVE-2026-84437
A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/c
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write a...
CVE-2026-84701
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without conten...
CVE-2026-84695
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accept
NocoBase Rich Text Field Stored Cross-Site Scripting via API
CVE-2026-84701
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store
BookStack before 26.05.4 Stored XSS via Drawing Upload
CVE-2026-84695
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accept
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization,...
CVE-2026-84477
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streami
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticate...
CVE-2026-84477
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streami
AVideo Stored XSS via Live Schedule Title Description
CVE-2026-84477
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streami
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
CVE-2026-84371
### Summary When SVG animation is allowed, `attributeName="href"` makes `values` a list of URL destinations. `sanitize-h
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, ...
CVE-2026-84371
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in ...
CVE-2026-84370
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in ...
CVE-2026-84369
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version
A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an adm...
CVE-2026-73781
A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious ...
CVE-2026-73524
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
CVE-2026-84371
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi