Threats Tagged 'cwe-87'

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize(), Sane::sanitize(), Sane::Html::sanitize(), Sane::Svg::sanitize(), Sane::Xml::sanitize(), Sane::sanitizeFile(), or file sanitizeContents() with untrusted input allow malicious markup injected as children of an unknown HTML or XML tag to pass through Dom::sanitize() without being correctly sanitized, causing stored cross-site scripting. This issue is fixed in versions 4.9.4 and 5.4.4.

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site Scripting (XSS) vulnerability in AutoGPT's signup page. The application improperly trusts a URL parameter (`next`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 0.6.62 patches the issue.

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including <script> tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain. This issue has been patched in version 1.10.3.

CVE-2026-25688 is a medium severity vulnerability in Apache Answer up to version 2.0.0. It involves improper neutralization of alternate cross-site scripting (XSS) syntax in AI-generated response content, which is rendered in the browser without proper sanitization. This flaw allows malicious scripts to execute when the content is viewed. The issue is fixed in version 2.0.1.

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel -> System -> Import/Export -> Dataflow - Profiles. This vulnerability is fixed in 20.18.0.

CVE-2026-42235 is a high-severity vulnerability in the n8n workflow automation platform affecting versions prior to 1.123.32, 2.17.4, and 2.18.1. It allows an unauthenticated attacker to register a malicious OAuth client with a crafted client_name that leads to improper neutralization of alternate XSS syntax. When a victim user authorizes the OAuth consent and another user revokes access, a toast notification renders injected script, enabling execution of arbitrary JavaScript in the victim's authenticated session. This can result in credential and session token theft, workflow manipulation, or privilege escalation.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.

Elementor Website Builder plugin for WordPress up to version 3.35.5 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with Contributor-level access or higher can inject malicious scripts via several widget parameters. These scripts execute when any user views the affected page. The vulnerability arises from insufficient input sanitization and output escaping. The CVSS score is 6.4, indicating a medium severity level. No official patch or remediation guidance is currently available. There are no known exploits in the wild at this time.

CVE-2026-22711 is a medium severity vulnerability in the Wikimedia Foundation's Mediawiki Wikilove Extension involving improper neutralization of alternate cross-site scripting (XSS) syntax. This flaw allows XSS attacks due to insufficient sanitization of input. The issue has been fixed in the master branch and release branches for MediaWiki versions 1.43, 1.44, and 1.45. No known exploits are reported in the wild. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a moderate risk level.