CWE-79

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "simplesamlphp/simplesamlphp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.18.0"
            },
            {
              "fixed": "1.18.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5226"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-01-24T21:09:37Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Background\n\nSimpleSAMLphp allows users to report errors and failures to the system administrators via a web form. This web form gathers some contextual information automatically, but it also allows the user to provide their email address for follow-ups and a free-text explanation of what happened. Once submitted, the report is sent as an email to the administrative email address configured in the software.\n\n### Description\n\nThe `www/erroreport.php` script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp  1.18.0, a new `SimpleSAML\\Utils\\EMail` class was introduced to handle sending emails, implemented as a wrapper of an external dependency.\n\nThis new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of the free-text field in `www/errorreport.php` was removed to avoid double escaping. However, for those not using the new user interface yet, an email template is hardcoded into the class itself in plain PHP. Since no escaping is provided in this template, it is then possible to inject HTML inside the template by manually crafting the contents of the free-text field.\n\n### Affected versions\n\nSimpleSAMLphp versions 1.18.0 to 1.18.3, both inclusive.\n\n### Impact\n\nAn attacker may take advantage of this issue to manually craft a modified email sent via the error reporting mechanism, such as this email might trick a system administrator into performing an action, such as introducing their credentials into a phishing web site that resembles the original.\n\nRemote execution of javascript code is considered unfeasible since email clients do not run javascript present in emails, although there might be email clients which don\u0027t follow this rule, making the attack surface grow.\n\n### Resolution\n\nUpgrade the SimpleSAMLphp installation to version 1.18.4.\n\n### Credit\n\nThis vulnerability was discovered and reported by Frederic Vleminckx.",
  "id": "GHSA-mj9p-v2r8-wf8w",
  "modified": "2021-01-08T20:32:54Z",
  "published": "2020-01-24T21:26:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-mj9p-v2r8-wf8w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5226"
    },
    {
      "type": "WEB",
      "url": "https://simplesamlphp.org/security/202001-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-site scripting in SimpleSAMLphp"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/shopware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.5.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-48150"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-21T19:55:03Z",
    "nvd_published_at": "2023-04-21T14:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.",
  "id": "GHSA-mj9r-fpv3-rgfx",
  "modified": "2025-02-05T16:45:55Z",
  "published": "2023-04-21T15:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48150"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sahilop123/-CVE-2022-48150"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shopware/shopware"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shopware vulnerable to cross-site scripting (XSS)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0501"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-13T20:15:45Z",
    "severity": "LOW"
  },
  "details": "A vulnerability has been found in SourceCodester House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Manage Invoice Details. The manipulation of the argument Invoice leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250609 was assigned to this vulnerability.",
  "id": "GHSA-mj9v-cjj7-ppr8",
  "modified": "2024-01-13T21:30:24Z",
  "published": "2024-01-13T21:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0501"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1xEenTDcXwNYdOxY8kdQ142nRnbcHrTRv/view?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.250609"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.250609"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-24426"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-12T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Backup by 10Web \u00e2\u20ac\u201c Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue",
  "id": "GHSA-mjc2-j72w-9227",
  "modified": "2024-04-04T03:10:52Z",
  "published": "2022-05-24T22:28:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24426"
    },
    {
      "type": "WEB",
      "url": "https://m0ze.ru/vulnerability/%5B2021-05-23%5D-%5BWordPress%5D-%5BCWE-79%5D-Backup-by-10Web-WordPress-Plugin-v1.0.20.txt"
    },
    {
      "type": "WEB",
      "url": "https://m0ze.ru/vulnerability/[2021-05-23]-[WordPress]-[CWE-79]-Backup-by-10Web-WordPress-Plugin-v1.0.20.txt"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/48464b3f-fe57-40fe-8868-398a36099fb9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-33371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-30T20:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the makehtml_list_action.php component.",
  "id": "GHSA-mjcf-7mv5-x748",
  "modified": "2024-08-01T15:31:43Z",
  "published": "2024-04-30T21:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33371"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/zchuanwen/cve/issues/I9HQRY"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-43995"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-18T00:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in sonalsinha21 Posterity allows Stored XSS.This issue affects Posterity: from n/a through 3.6.",
  "id": "GHSA-mjcr-8w57-83q9",
  "modified": "2024-09-18T00:31:12Z",
  "published": "2024-09-18T00:31:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43995"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/posterity/wordpress-posterity-theme-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-12040"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-13T22:29:00Z",
    "severity": "MODERATE"
  },
  "details": "** DISPUTED ** Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the \"file\" parameter, aka an _profiler/open?file= URI.  NOTE: The vendor states \"The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don\u0027t handle those issues as security issues).\"",
  "id": "GHSA-mjcw-3g32-5p52",
  "modified": "2022-05-14T01:27:14Z",
  "published": "2022-05-14T01:27:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12040"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/148125/SensioLabs-Symfony-3.3.6-Cross-Site-Scripting.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/542071/100/0/threaded"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-11694"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-26T14:15:18Z",
    "severity": "MODERATE"
  },
  "details": "Enhanced Tracking Protection\u0027s Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox \u003c 133, Firefox ESR \u003c 128.5, Firefox ESR \u003c 115.18, Thunderbird \u003c 133, and Thunderbird \u003c 128.5.",
  "id": "GHSA-mjcw-r3mg-3848",
  "modified": "2025-11-04T00:32:07Z",
  "published": "2024-11-26T15:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11694"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1924167"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2024-63"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2024-64"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2024-65"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2024-67"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2024-68"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2024-70"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "storybook"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.0"
            },
            {
              "fixed": "8.6.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "storybook"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.7.0-alpha.0"
            },
            {
              "fixed": "9.1.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "storybook"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-beta.0"
            },
            {
              "fixed": "10.2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27148"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1385",
      "CWE-74",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-26T15:16:10Z",
    "nvd_published_at": "2026-02-25T22:16:25Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe WebSocket functionality in Storybook\u0027s dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability **only affects the Storybook dev server; production builds are not impacted**.\n\n### Details\n\nExploitation requires a developer to visit a malicious website while their local Storybook dev server is running. Because the WebSocket connection does not validate the origin of incoming connections, a malicious site can silently send WebSocket messages to the local instance without any further user interaction.\n\nIf a Storybook dev server is intentionally exposed publicly (e.g. for design reviews or stakeholder demos) the risk is higher, as no malicious site visit is required. Any unauthenticated attacker can send WebSocket messages to it directly.\n\nThe vulnerability affects the WebSocket message handlers for creating and saving stories, which can be exploited via unauthorized WebSocket connections to achieve persistent XSS or Remote Code Execution (RCE).\n\n_Note: recent versions of Chrome have some protections against this, but Firefox does not._\n\n### Impact\nThis vulnerability can lead to supply chain compromise. Key risks include:\n\n- **Remote Code Execution**: The vulnerability can allow attackers to execute malicious code, with the extent of impact depending on the configuration. Server-side RCE is possible in non-default configurations, such as when stories are executed via portable stories in JSDOM, potentially allowing attackers to exfiltrate credentials and environment variables, access source code and the filesystem, establish backdoors, or pivot to internal network resources.\n- **Persistent XSS**: Malicious payloads are written directly into story source files. If the malicious payload is committed to version control, it becomes part of the codebase and can propagate to deployed Storybook documentation sites, affecting developers and stakeholders who view them.\n- **Supply Chain Propagation**: If the modified source files are committed, injected code can spread to other team members via git, execute in CI/CD pipelines, and affect shared component libraries used across multiple projects.\n\n### Affected versions\n\n8.1 and above. While the exploitable functionality was introduced in 8.1, the patch has been applied to 7.x as a precautionary measure given the underlying WebSocket behaviour.\n\n### Recommended actions\nUpdate to one of the patched versions: `7.6.23`, `8.6.17`, `9.1.19`, `10.2.10`.",
  "id": "GHSA-mjf5-7g4m-gx5w",
  "modified": "2026-02-26T15:16:10Z",
  "published": "2026-02-26T15:16:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-mjf5-7g4m-gx5w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27148"
    },
    {
      "type": "WEB",
      "url": "https://github.com/storybookjs/storybook/commit/0affdf928bd6fafbadfb1dfe22ce6104805e10e8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/storybookjs/storybook/commit/54689a8add18ea75d628c540f4bc677592a1e685"
    },
    {
      "type": "WEB",
      "url": "https://github.com/storybookjs/storybook/commit/b8cfa77c73940c140acdcd8a06ab1ea913c44761"
    },
    {
      "type": "WEB",
      "url": "https://github.com/storybookjs/storybook/commit/d34085f39c647f5c23c3a3b2d197c18602fcf876"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/storybookjs/storybook"
    },
    {
      "type": "WEB",
      "url": "https://github.com/storybookjs/storybook/releases/tag/v10.2.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/storybookjs/storybook/releases/tag/v7.6.23"
    },
    {
      "type": "WEB",
      "url": "https://github.com/storybookjs/storybook/releases/tag/v8.6.17"
    },
    {
      "type": "WEB",
      "url": "https://github.com/storybookjs/storybook/releases/tag/v9.1.19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Storybook Dev Server is Vulnerable to WebSocket Hijacking"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-37470"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-25T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.",
  "id": "GHSA-mjf7-37pm-5wf4",
  "modified": "2022-05-24T19:09:06Z",
  "published": "2022-05-24T19:09:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37470"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_XSS.md"
    },
    {
      "type": "WEB",
      "url": "https://www.nch.com.au/webdictate/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}