#cwe-79

共收录 5426 条相关情报。

← 返回所有主题

安全公告2026-09-17 发布INFO

Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

CVE-2026-75834

## Vulnerability Details **Component**: getgrav/grav core **File**: `system/src/Grav/Common/Security.php` **Function**:

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-79 #severity:medium

安全公告2026-09-17 发布INFO

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

CVE-2026-75828

## Affected versions and vulnerable location - Confirmed on grav core at `78ebfc1` (tag 2.0.13). - Detector: `system/sr

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-79 #severity:critical

安全公告2026-09-17 发布INFO

@platejs/core HTML deserialization can trigger browser behavior during parsing

CVE-2026-88976

### Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #severity:medium

安全公告2026-09-17 发布INFO

djust: A template binding inherits a context safety grant it never earned (XSS)

A context safety grant was inherited by a template **binding** that never earned it, so rebinding a name the view had ma

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-79 #cwe-116 #severity:high

安全公告2026-09-17 发布INFO

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

Five independent defects in djust's template auto-escaping cause attacker-controlled input to be rendered as live markup

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-79 #cwe-116 #severity:high

漏洞预警2026-09-17 发布INFO

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled...

CVE-2026-54253

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in pac

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-09-17 发布INFO

TS3 Manager: Reflected XSS via /api/download port parameter steals operator session

CVE-2026-54253

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in pac

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79

漏洞预警2026-09-17 发布INFO

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card (event_general.ctp) and the server/feed preview ...

CVE-2026-93296

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event Gene

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or cr...

CVE-2026-92986

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attack

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files w...

CVE-2026-92985

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-compone...

CVE-2026-63459

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers control...

CVE-2026-92973

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that f

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.

CVE-2026-90986

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.

CVE-2026-90887

Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

CVE-2026-78294

Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.

CVE-2026-66617

Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.

CVE-2026-66579

Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.

CVE-2026-66578

Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.

CVE-2026-66577

Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-09-17 发布INFO

Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.

CVE-2026-66576

Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-79