https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 03:18:09 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-102426 <p>Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_&lt;fieldId&gt; request parameter, split on the delimiter &#34;l-r&#34;, HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element&#39;s text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_&lt;fieldId&gt; value.</p> <p>Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_&lt;fieldId&gt; request parameter, split on the delimiter &#34;l-r&#34;, HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element&#39;s text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_&lt;fieldId&gt; value.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-102426 https://vulnerability.circl.lu/vuln/ghsa-rwqh-f6r7-qgh8 <p>Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_&lt;fieldId&gt; request parameter, split on the delimiter &#34;l-r&#34;, HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element&#39;s text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_&lt;fieldId&gt; value.</p> <p>Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_&lt;fieldId&gt; request parameter, split on the delimiter &#34;l-r&#34;, HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element&#39;s text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_&lt;fieldId&gt; value.</p> https://vulnerability.circl.lu/vuln/ghsa-rwqh-f6r7-qgh8