#cwe-79

共收录 5376 条相关情报。

漏洞预警2026-09-26 发布INFO

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying ...

CVE-2026-100643

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing a

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-26 发布INFO

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCa...

CVE-2026-100641

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager l

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-26 发布INFO

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/g...

CVE-2026-100639

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutt

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-26 发布INFO

AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upl...

CVE-2026-100630

AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an i

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-09-26 发布INFO

Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

CVE-2026-100720

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authen

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-26 发布INFO

Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE

CVE-2026-100695

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpol

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-26 发布INFO

Hugo before 0.166.0 Cross-Site Scripting via text/org

CVE-2026-100694

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-26 发布INFO

Hugo before 0.166.0 Stored XSS via lineAnchors code block option

CVE-2026-100691

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does no

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-26 发布INFO

Grav Data Manager before 1.4.5 Stored XSS via item-detail view

CVE-2026-100673

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries i

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-26 发布INFO

SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban

CVE-2026-100645

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database re

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-26 发布INFO

SiYuan before v3.8.4 Stored XSS via Attribute View textarea

CVE-2026-100643

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing a

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-26 发布INFO

SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content

CVE-2026-100641

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager l

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

安全公告2026-09-26 发布INFO

SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL

CVE-2026-100639

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutt

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-09-26 发布INFO

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequer...

CVE-2026-100313

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-09-26 发布INFO

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file...

CVE-2026-100311

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-94

漏洞预警2026-09-26 发布INFO

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing u...

CVE-2026-96531

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before re

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-26 发布INFO

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, a...

CVE-2026-92411

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-26 发布INFO

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origi...

CVE-2026-85081

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPres

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-26 发布INFO

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting...

CVE-2026-84096

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that sa

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-26 发布INFO

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visi...

CVE-2026-84095

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers

历史摘要 · 未重新核验 · NVD

#cve #cwe-79