#cwe-79

共收录 5879 条相关情报。

漏洞预警2026-07-15 发布INFO

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user ...

CVE-2026-1563

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a u

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-15 发布INFO

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user wit...

CVE-2026-1562

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-07-15 发布INFO

RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

CVE-2026-62378

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS C

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-07-15 发布INFO

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting (XSS)....

CVE-2026-9007

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-15 发布INFO

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title an...

CVE-2026-41580

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirl

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-07-15 发布INFO

Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)

CVE-2026-41580

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirl

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-07-15 发布INFO

Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. ...

CVE-2026-61453

Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detec

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-07-15 发布INFO

Grav before 2.0.1 XSS via Twig String Concatenation

CVE-2026-61453

Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detec

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-07-15 发布INFO

The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances.

CVE-2026-58077

The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated requ

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-15 发布INFO

The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature.

CVE-2026-57833

The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-14 发布INFO

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escap...

CVE-2026-47730

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplat

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-14 发布INFO

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to trea...

CVE-2026-46637

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra a

历史摘要 · 未重新核验 · NVD

#cve #cwe-116 #cwe-79

漏洞预警2026-07-14 发布INFO

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchC...

CVE-2026-42447

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-07-14 发布INFO

jadx: HTML Injection in Summary panel

CVE-2026-42447

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-07-14 发布INFO

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could...

CVE-2026-48320

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-79 #severity:high

安全公告2026-07-14 发布INFO

Twig: XSS in profiler HtmlDumper via unescaped template and profile names

CVE-2026-47730

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-07-14 发布INFO

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an eleme...

CVE-2026-49978

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE san

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-07-14 发布INFO

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attri...

CVE-2026-49459

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(roo

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-693 #cwe-1321

漏洞预警2026-07-14 发布INFO

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm...

CVE-2026-49458

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(nod

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-501 #cwe-693

漏洞预警2026-07-14 发布INFO

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potenti...

CVE-2026-48320

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79