https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:20:37 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-2445 <p>The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.</p> <p>An attacker can leverage this vulnerability to cause the user&#39;s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.</p> <p>The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.</p> <p>An attacker can leverage this vulnerability to cause the user&#39;s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-2445 https://vulnerability.circl.lu/vuln/ghsa-vcj5-r64m-jr4f <p>The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.</p> <p>An attacker can leverage this vulnerability to cause the user&#39;s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.</p> <p>The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.</p> <p>An attacker can leverage this vulnerability to cause the user&#39;s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.</p> https://vulnerability.circl.lu/vuln/ghsa-vcj5-r64m-jr4f