https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:49:39 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-85196 <p>Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla &lt; 20.0.0, Users Anywhere extension for Joomla &lt; 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla&#39;s string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event attribute in output configured by a site author.</p> <p>Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla &lt; 20.0.0, Users Anywhere extension for Joomla &lt; 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla&#39;s string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event attribute in output configured by a site author.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-85196 https://vulnerability.circl.lu/vuln/ghsa-xh7r-fjj6-r3qm <p>Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla &lt; 20.0.0, Users Anywhere extension for Joomla &lt; 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla&#39;s string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event attribute in output configured by a site author.</p> <p>Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla &lt; 20.0.0, Users Anywhere extension for Joomla &lt; 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is used. Joomla&#39;s string input filter does not make the same value safe for HTML text, an HTML attribute and a URL. A visitor-controlled request value can therefore become an executable URL or a new event attribute in output configured by a site author.</p> https://vulnerability.circl.lu/vuln/ghsa-xh7r-fjj6-r3qm