https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:30:21 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-64628 <p>Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer&#39;s browser, including administrators, enabling session hijacking via admin nonce theft.</p> <p>Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer&#39;s browser, including administrators, enabling session hijacking via admin nonce theft.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-64628 https://vulnerability.circl.lu/vuln/ghsa-r7ww-mw2x-mj59 <p>Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer&#39;s browser, including administrators, enabling session hijacking via admin nonce theft.</p> <p>Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer&#39;s browser, including administrators, enabling session hijacking via admin nonce theft.</p> https://vulnerability.circl.lu/vuln/ghsa-r7ww-mw2x-mj59