CWE-79

{
  "affected": [],
  "aliases": [
    "CVE-2014-4946"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-07-14T14:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.",
  "id": "GHSA-ffjw-6mf8-2rj5",
  "modified": "2022-05-17T04:39:54Z",
  "published": "2022-05-17T04:39:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/horde/horde/blob/4513649810f13a32f1193bdeed76f7d85a5efa05/bundles/webmail/docs/CHANGES"
    },
    {
      "type": "WEB",
      "url": "https://github.com/horde/horde/blob/c0144ac03814a8c2cf6fc5ac0d1af2653e9ee139/imp/docs/CHANGES"
    },
    {
      "type": "WEB",
      "url": "http://lists.horde.org/archives/announce/2014/001019.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.horde.org/archives/announce/2014/001025.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59770"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59772"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-15292"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T05:16:32Z",
    "severity": "MODERATE"
  },
  "details": "The Sudoku Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027background\u0027 parameter in the \u0027sudoku-sc\u0027 shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
  "id": "GHSA-ffm3-68jx-q7h9",
  "modified": "2026-07-10T06:31:21Z",
  "published": "2026-07-10T06:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15292"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/sudoku-shortcode/tags/1.0.0/sudoku-shortcode.php#L63"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/sudoku-shortcode/tags/1.0.0/sudoku-shortcode.php#L73"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/sudoku-shortcode/trunk/sudoku-shortcode.php#L63"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/sudoku-shortcode/trunk/sudoku-shortcode.php#L73"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99e4b38c-f81d-4578-a623-ea62495e934d?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-19507"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-12-19T19:29:00Z",
    "severity": "MODERATE"
  },
  "details": "CMSimple 4.7.5 has XSS via an admin\u0027s use of a ?file=config\u0026action=array URI.",
  "id": "GHSA-ffm4-5w5h-7r42",
  "modified": "2022-05-14T01:32:21Z",
  "published": "2022-05-14T01:32:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19507"
    },
    {
      "type": "WEB",
      "url": "https://github.com/security-breachlock/CVE-2018-19507/blob/master/Persistent-XSS.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-6173"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-02-19T16:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site scripting (XSS) vulnerability in fullscreen.php in ClipShare Pro 4.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter.",
  "id": "GHSA-ffm6-99w7-ph6f",
  "modified": "2022-05-17T02:12:07Z",
  "published": "2022-05-17T02:12:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6173"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46072"
    },
    {
      "type": "WEB",
      "url": "http://downloads.securityfocus.com/vulnerabilities/exploits/31898.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/32399"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/31898"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-43005"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-16T20:15:13Z",
    "severity": "MODERATE"
  },
  "details": "A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user\u0027s browser via injecting a crafted payload.",
  "id": "GHSA-ffm7-5xwh-8f68",
  "modified": "2024-08-19T21:35:08Z",
  "published": "2024-08-16T21:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43005"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43005%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS2.md"
    },
    {
      "type": "WEB",
      "url": "http://zzcms.net"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-25612"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-17T15:15:43Z",
    "severity": "HIGH"
  },
  "details": "FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the \"Time Range Name\" field, which is improperly sanitized. When this input is saved, it is later executed in the browser of any user accessing the affected page, including administrators, resulting in arbitrary script execution in the user\u0027s browser.",
  "id": "GHSA-ffm8-j238-56p4",
  "modified": "2025-03-17T18:31:52Z",
  "published": "2025-03-17T15:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25612"
    },
    {
      "type": "WEB",
      "url": "https://github.com/secmuzz/CVE-2025-25612"
    },
    {
      "type": "WEB",
      "url": "http://fs.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-10703"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-25T06:15:38Z",
    "severity": "MODERATE"
  },
  "details": "The Registrations for the Events Calendar  WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
  "id": "GHSA-ffm9-v534-h8c2",
  "modified": "2025-03-25T15:31:28Z",
  "published": "2025-03-25T06:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10703"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/5601ac03-09e4-4b4e-b03e-98323bd36dba"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-42786"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-10T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple W\u0026T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage",
  "id": "GHSA-ffmc-cj3h-9wwj",
  "modified": "2022-11-10T19:01:11Z",
  "published": "2022-11-10T19:01:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42786"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/de/advisories/VDE-2022-043"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-40732"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-09T18:15:11Z",
    "severity": "MODERATE"
  },
  "details": "A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/add/.",
  "id": "GHSA-ffmc-gvp5-pfrx",
  "modified": "2024-07-11T03:30:54Z",
  "published": "2024-07-09T18:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40732"
    },
    {
      "type": "WEB",
      "url": "https://github.com/minhquan202/Vuln-Netbox"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-rc.9"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.0-rc.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58657"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-16T22:14:53Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nGrav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct `?style=` payloads and unsafe `attribute()` fallbacks, but the adjacent `resize()` action still writes caller-controlled values directly into `styleAttributes`.\n\nA publisher who can edit page Markdown can store a crafted image URL that renders additional CSS declarations in the final `\u003cimg style=...\u003e` attribute. This crosses the same lower-privileged publisher to higher-privileged reviewer/admin rendered-content boundary as the earlier media style and attribute advisories.\n\n## Impact\n\nA lower-privileged content editor can persist CSS declarations that are rendered when a higher-privileged user views the page or admin preview. The demonstrated payload creates a full-viewport fixed overlay by injecting `position:fixed`, viewport dimensions, background color, and z-index declarations.\n\nThis does not require JavaScript execution. The impact is stored CSS injection in rendered content, with UI redress/overlay and content-manipulation risk in higher-privileged sessions.\n\n## Reproduction\n\nTested versions:\n\n- Grav 2.0 branch commit `6582166173bb8eb5869d96aea384e0e73777c94c`\n- Grav `2.0.0-rc.9` commit `e03d29aa0d3ece16d73c1ffccfa78df8bf5f28b8`\n\nMinimal Markdown payload:\n\n```markdown\n![logo](image.png?resize=100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999,200)\n```\n\nA minimal PHPUnit-style reproducer can drive the same parser path directly:\n\n```php\n$m = new class {\n    use \\Grav\\Common\\Media\\Traits\\MediaObjectTrait;\n    use \\Grav\\Common\\Media\\Traits\\StaticResizeTrait;\n\n    public function addMetaFile($filepath) {}\n    public function __toString(): string { return \u0027\u0027; }\n    public function url($reset = true) { return \u0027/img.png\u0027; }\n    public function get($name, mixed $default = null, $separator = null) { return $default; }\n    public function set($name, mixed $value, $separator = null) { return $this; }\n    protected function createThumbnail($thumb) { return null; }\n    protected function createLink(array $attributes) { return null; }\n    protected function getItems(): array { return []; }\n};\n\n$excerpts = new \\Grav\\Common\\Page\\Markdown\\Excerpts(null, [\u0027markdown\u0027 =\u003e [], \u0027images\u0027 =\u003e []]);\n$m = $excerpts-\u003eprocessMediaActions(\n    $m,\n    \u0027image.png?resize=100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999,200\u0027\n);\n$element = $m-\u003eparsedownElement(\u0027\u0027, \u0027\u0027, \u0027\u0027, \u0027\u0027, false);\nvar_dump($element[\u0027attributes\u0027][\u0027style\u0027]);\n```\n\nObserved style attribute:\n\n```text\nwidth: 100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999px;height: 200px;\n```\n\nThe appended `px` lands on the final `z-index` value, but the preceding injected declarations remain syntactically valid CSS.\n\n## Root Cause / Technical Details\n\n`system/src/Grav/Common/Page/Markdown/Excerpts.php::processMediaActions()` parses the image query string into media actions and invokes the requested public media method with `call_user_func_array([$medium, $action[\u0027method\u0027]], $args)`.\n\nFor `resize()`, `system/src/Grav/Common/Media/Traits/StaticResizeTrait.php::resize()` stores width and height directly into style attributes:\n\n```php\n$this-\u003estyleAttributes[\u0027width\u0027] = $width . \u0027px\u0027;\n$this-\u003estyleAttributes[\u0027height\u0027] = $height . \u0027px\u0027;\n```\n\nIt does not verify that the values are numeric, length-only, or free of CSS declaration delimiters. Later, `system/src/Grav/Common/Media/Traits/MediaObjectTrait.php::parsedownElement()` serializes keyed style attributes as raw CSS declarations:\n\n```php\n$style .= $key . \u0027: \u0027 . $value . \u0027;\u0027;\n```\n\nThe sanitizer added for direct `style()` inputs is not reached for values introduced by `resize()`. As a result, `resize=100;position:fixed;...,200` breaks out of the intended `width:` value and injects additional declarations.\n\n## PoC Evidence\n\nOn both current 2.0 and 2.0.0-rc.9, the targeted regression test produced the injected style string above. Existing tests still confirm the direct `style()` and `attribute()` paths are rejected; the bypass is specific to the adjacent `resize()` styleAttributes path.\n\n## Remediation\n\nSanitize or type-normalize all values before they enter `styleAttributes`, not only values passed through `MediaObjectTrait::style()`. For `resize()`, cast or validate width and height as numeric values before appending `px`, or use a shared CSS declaration builder that rejects semicolons, colons, property names, and other declaration-breaking characters. Add regression coverage for `resize=100;position:fixed;top:0,200` and any other media action that writes to `styleAttributes` directly.",
  "id": "GHSA-ffmg-hfvg-jhg9",
  "modified": "2026-09-16T22:14:53Z",
  "published": "2026-09-16T22:14:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-ffmg-hfvg-jhg9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58657"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/6582166173bb8eb5869d96aea384e0e73777c94c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/e03d29aa0d3ece16d73c1ffccfa78df8bf5f28b8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-stored-css-injection-via-markdown-image-resize-action"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav"
}