XSS vulnerability in <ansi2html-1.9.4
ansi2html before 1.9.4 converted crafted sr.ht CI log lines into HTML, enabling XSS for viewers.
Stories per day · 30 days
1 RSS
3 stories, newest first · one card per story
Stories tagged #html-injection
CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method
CVE-2026-85630: HTML::FormHandler Perl versions before 0.410002 render field attributes into HTML unescaped, enabling HTML injection.
ZDI-26-607: Microsoft Office HTML Injection Information Disclosure Vulnerability
ZDI disclosed an HTML injection flaw in Microsoft Office (CVSS 7.6) that lets remote attackers disclose sensitive information via malicious pages or files.