#cwe-79

共收录 5770 条相关情报。

← 返回所有主题

漏洞预警2026-08-15 发布CRITICAL

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft docu...

CVE-2026-73053

CVE-2026-73053 是思源笔记（SiYuan）v3.7.4 之前版本中存在的一个跨站脚本（XSS）漏洞，具体位于 unicode2Emoji 函数中。该函数在处理 Unicode 码位分支输出时未能进行有效的清理，导致攻击者可以构

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布CRITICAL

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can in...

CVE-2026-73052

CVE-2026-73052 是笔记软件 SiYuan（思源）在 v3.7.4 之前版本中存在的一个高危存储型 XSS 漏洞。漏洞根源在于属性视图（attribute-view）的字段名在存储时未进行 HTML 转义，随后在排序菜单中通过

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布CRITICAL

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render si...

CVE-2026-73050

CVE-2026-73050是开源笔记应用SiYuan（思源）中存在的一处存储型跨站脚本（XSS）漏洞。该漏洞影响v3.7.4之前的版本，根因在于属性视图（Attribute View）中select选项的颜色字段缺少充分的输入验证与输出转

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布INFO

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject ma...

CVE-2026-73044

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布INFO

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verb...

CVE-2026-73043

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布INFO

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit m...

CVE-2026-73042

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to ex

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布INFO

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotati...

CVE-2026-73041

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endp

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布INFO

A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Performing a manipulatio...

CVE-2026-19916

A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

安全公告2026-08-15 发布INFO

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability...

CVE-2026-19904

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-79 #severity:low

漏洞预警2026-08-15 发布INFO

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the componen...

CVE-2026-19904

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-08-15 发布INFO

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (Button Code) Settin...

CVE-2026-17090

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布INFO

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versi...

CVE-2026-16145

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cro

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布INFO

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up...

CVE-2026-15948

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Sc

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布INFO

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, ...

CVE-2026-13360

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scriptin

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-15 发布INFO

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in all versions...

CVE-2026-14433

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site

历史摘要 · 未重新核验 · NVD

安全公告2026-08-14 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute...

CVE-2026-17209

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to c

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-79 #severity:medium

漏洞预警2026-08-14 发布INFO

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting.

CVE-2026-17209

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to c

历史摘要 · 未重新核验 · NVD

安全公告2026-08-14 发布INFO

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML ed

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-79 #severity:high

漏洞预警2026-08-14 发布INFO

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters a...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML ed

历史摘要 · 未重新核验 · NVD

漏洞预警2026-08-14 发布INFO

A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an authenticated attacker to store a malicious `javascript:`...

CVE-2026-53472

A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an

历史摘要 · 未重新核验 · NVD