CWE-79

{
  "affected": [],
  "aliases": [
    "CVE-2025-48352"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-28T13:15:54Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in sitesearch-yandex Yandex Site search pinger allows Stored XSS. This issue affects Yandex Site search pinger: from n/a through 1.5.",
  "id": "GHSA-w8xw-8c6q-x9g3",
  "modified": "2026-04-01T18:35:59Z",
  "published": "2025-08-28T15:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48352"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/yandex-pinger/vulnerability/wordpress-yandex-site-search-pinger-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-0955"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-05-22T11:14:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0 before 8.0.0.1 CF12, when Social Rendering in Connections integration is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.",
  "id": "GHSA-w92m-98xc-4j5r",
  "modified": "2022-05-17T01:27:33Z",
  "published": "2022-05-17T01:27:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0955"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92628"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI15583"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21672572"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2012-6715"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-08-21T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.",
  "id": "GHSA-w92q-8j7f-w2g3",
  "modified": "2024-04-03T23:06:39Z",
  "published": "2022-04-23T00:40:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6715"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/formbuilder/#developers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-6877"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-18T15:15:18Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Eliz Software Panel allows Reflected XSS.This issue affects Panel: before v2.3.24.",
  "id": "GHSA-w92r-xm6v-f2vj",
  "modified": "2026-06-03T15:30:35Z",
  "published": "2024-09-18T15:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6877"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1497"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-24-1497"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-29024"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-11T18:15:13Z",
    "severity": "MODERATE"
  },
  "details": "\nA cross site scripting vulnerability was discovered in Rockwell Automation\u0027s ArmorStart ST product \n\nA cross site scripting vulnerability was discovered that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability.\n\n\n\n",
  "id": "GHSA-w92v-v6pq-mwmx",
  "modified": "2023-12-20T03:30:22Z",
  "published": "2023-05-11T18:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29024"
    },
    {
      "type": "WEB",
      "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-11059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-24T19:29:00Z",
    "severity": "MODERATE"
  },
  "details": "RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.",
  "id": "GHSA-w92w-87vr-h7fh",
  "modified": "2022-05-13T01:34:52Z",
  "published": "2022-05-13T01:34:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11059"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2018/Jul/69"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/104892"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1041359"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-11656"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-10-04T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027).",
  "id": "GHSA-w92w-c9qq-339w",
  "modified": "2024-04-04T02:08:35Z",
  "published": "2022-05-24T16:57:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11656"
    },
    {
      "type": "WEB",
      "url": "https://community.microfocus.com/t5/ArcSight-Announcements/ArcSight-Logger-Fix-for-Security-Vulnerability/td-p/2699569"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "locize"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41886"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-22T20:32:11Z",
    "nvd_published_at": "2026-05-08T16:16:12Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nVersions of the `locize` client SDK (the browser module that wires up the locize InContext translation editor) prior to 4.0.21 register a `window.addEventListener(\"message\", \u2026)` handler that dispatches to registered internal handlers (`editKey`, `commitKey`, `commitKeys`, `isLocizeEnabled`, `requestInitialize`, \u2026) **without validating `event.origin`**.\n\nThe pre-patch listener in `src/api/postMessage.js` gates dispatch on `event.data.sender === \"i18next-editor-frame\"` \u2014 that value sits inside the attacker-controlled message payload, not the browser-enforced origin. Any web page that could embed or be embedded by a locize-enabled host \u2014 an iframe on a third-party page, a `window.open`-ed victim, a parent frame reaching down \u2014 could send a crafted `postMessage` and trigger the internal handlers.\n\n### Impact\n\nDepending on which handler the attacker invokes, distinct consequences follow. All of them share the same root cause: the handlers implicitly assumed the payload came from the real editor iframe.\n\n- **Cross-origin DOM XSS** via `editKey` / `commitKeys`: the pre-patch `handleEditKey` assigned attacker-controlled payload values to `item.node.innerHTML` and to `item.node.setAttribute(attr, value)`. That allowed planting `\u003cscript\u003e`, `\u003cimg onerror\u003e`, or `onclick`/`onload`/`onfocus` event handlers; and on attribute writes, `href=\"javascript:\u2026\"` / `src=\"data:text/html,\u003cscript\u003e\u2026\"` / `style=\"\u2026\"` / etc.\n\n- **`api.source` / `api.origin` hijack** via `isLocizeEnabled`: the handler set `api.source = e.source; api.origin = e.origin` \u2014 attacker-controlled values. All subsequent `sendMessage` calls (which post translations, callbacks, etc., back toward `api.source`) would go to the attacker window rather than the real editor, leaking translation content and any metadata the SDK forwards.\n\n- **CSS-injection / layout-escape** via `requestPopupChanges`: `containerStyle.height` / `.width` were interpolated into `calc()` expressions and `popup.style.setProperty()` without validation, allowing attackers to inject additional CSS declarations (semicolons, `behavior:url()` on legacy IE, CSS-exfil patterns) into the popup inline style.\n\nExploitation requires the attacker-owned page to share a window reference with the locize-enabled host: typical vectors are an `iframe` on an attacker-controlled page, a `window.opener`/`window.open` relationship, or a parent frame that can `postMessage` into an embedded locize host. The SDK intended model is that only the editor iframe at `https://incontext.locize.app` (or the configured staging/development origin) can reach these handlers.\n\n### Affected versions\n\nAll versions of `locize` prior to **4.0.21**.\n\n### Patch\n\nFixed in **4.0.21**. Two layers:\n\n1. **Primary** \u2014 validate `event.origin` at the top of `window.addEventListener(\"message\", \u2026)` in `src/api/postMessage.js`. The expected origin is the configured iframe origin (`getIframeUrl()`), so custom environments continue to work. Messages from any other origin are silently dropped before any handler runs.\n\n2. **Defence-in-depth** \u2014 `handleEditKey` now rejects dangerous attribute-name writes (`on*`, `style`) and `javascript:` / `data:` / `vbscript:` / `file:` URLs on `href` / `src` / `action` / `formaction` / `xlink:href`; `innerHTML` assignments are sanitised through a throwaway DOMParser document (stripping `\u003cscript\u003e`, `\u003ciframe\u003e`, `\u003cobject\u003e`, `\u003cembed\u003e`, `\u003clink\u003e`, `\u003cmeta\u003e`, `\u003cbase\u003e`, `\u003cstyle\u003e` plus event handlers and dangerous URL schemes). Legitimate translation formatting (`\u003cb\u003e`, `\u003cem\u003e`, `\u003cstrong\u003e`, `\u003ca href=\"https://\u2026\"\u003e`, etc.) passes through.\n\n3. **CSS-injection** \u2014 `handleRequestPopupChanges` now requires `containerStyle.height` / `.width` to match a strict CSS length pattern; malformed values are dropped silently.\n\n### Workarounds\n\nNo workaround short of upgrading.\n\n### Credits\n\nDiscovered via an internal security audit of the locize ecosystem.",
  "id": "GHSA-w937-fg2h-xhq2",
  "modified": "2026-05-13T13:30:12Z",
  "published": "2026-04-22T20:32:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/locize/locize/security/advisories/GHSA-w937-fg2h-xhq2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41886"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locize/locize/commit/d006b75fadb8e8ab77b023e462850fc6e9170735"
    },
    {
      "type": "WEB",
      "url": "https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/locize/locize"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locize/locize/releases/tag/v4.0.21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "locize Client SDK: Cross-origin DOM XSS \u0026 Handler Hijack Through Missing e.origin Validation in InContext Editor "
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-36153"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-13T08:16:03Z",
    "severity": "MODERATE"
  },
  "details": "Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.",
  "id": "GHSA-w939-7ww2-rwgw",
  "modified": "2024-06-13T09:30:58Z",
  "published": "2024-06-13T09:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36153"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-0896"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-03-18T23:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
  "id": "GHSA-w93f-wmr5-rjc6",
  "modified": "2022-05-17T04:14:51Z",
  "published": "2022-05-17T04:14:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0896"
    },
    {
      "type": "WEB",
      "url": "http://extplorer.net/news/16"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN97099798/index.html"
    },
    {
      "type": "WEB",
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000039"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}