Threats Tagged 'cwe-86'

A cross-site scripting (XSS) vulnerability exists in the league/commonmark PHP library's AttributesExtension between versions 1.5.0 and 2.9.0. The unsafe-link filter for href and src attributes can be bypassed by embedding control bytes in javascript: URLs, which browsers discard before parsing the scheme, allowing script execution despite the filter. This issue is fixed in version 2.9.0.

CVE-2025-66606 is a low-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue stems from improper URL encoding, which could allow an attacker to tamper with web pages or execute malicious scripts via crafted URLs. Exploitation requires user interaction and has a low impact on confidentiality, with no authentication needed but high attack complexity. No known exploits are currently reported in the wild. The vulnerability affects several FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. European organizations using these versions in industrial control or monitoring environments should be aware but face limited risk due to the low severity and complexity. Mitigation involves applying vendor patches once available, implementing strict input validation, and restricting access to the affected web interfaces. Countries with significant industrial automation sectors using Yokogawa products, such as Germany, France, Italy, and the UK, are more likely to be impacted.

LowVulnerabilityGermanyFranceItaly+4#cve#cve-2025-66606#cwe-86