Common Weakness Enumeration

CWE-80

Allowed

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Abstraction: Variant · Status: Incomplete

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

1041 vulnerabilities reference this CWE, most recent first.

GHSA-V73P-F52R-FMMR

Vulnerability from github – Published: 2026-06-22 09:30 – Updated: 2026-09-11 22:05

Summary

Apache Atlas UI: Authenticated User XSS

Details

An authenticated user can perform XSS.

This issue affects Apache Atlas versions 2.4.0 and earlier.

Users are recommended to upgrade to version 2.5.0, which fixes the issue.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.atlas:atlas-dashboardv2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T22:05:26Z",
    "nvd_published_at": "2026-06-22T08:16:35Z",
    "severity": "MODERATE"
  },
  "details": "An authenticated user can perform XSS.\n\nThis issue affects Apache Atlas versions 2.4.0 and earlier.\n\nUsers are recommended to upgrade to version 2.5.0, which fixes the issue.",
  "id": "GHSA-v73p-f52r-fmmr",
  "modified": "2026-09-11T22:05:26Z",
  "published": "2026-06-22T09:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62198"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/atlas/commit/800f979307d6ea0f0b6563ec890f6b728022e497"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/atlas"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/nv893lhz3ok08f25j3v4z1to5nrpdp7k"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/06/20/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Atlas UI: Authenticated User XSS"
}

GHSA-V75V-6FPF-GVW8

Vulnerability from github – Published: 2026-10-15 20:16 – Updated: 2026-10-15 20:16

Summary

Vitess vttablet /twopcz reflected XSS

Details

From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800

Summary

The twopczHandler in go/vt/vttablet/tabletserver/twopcz.go (line 185) reflects the Action and dtid form values directly into the HTML response body via fmt.Fprintln(w, msg) — without HTML escaping. The response is served as text/html; charset=utf-8, and Vitess's default acl policy is allow-all, so the endpoint is reachable by anyone who can hit the vttablet's HTTP port (default 15999, multiplexed with gRPC and MySQL wire-protocol ports).

A crafted Action or dtid value yields a reflected XSS that executes in the operator's browser with same-origin access to the vttablet's debug endpoints. This includes /queryz (live query plans), /querylogz (recent queries with bound values), /txlogz (transactions), /debug/env (environment variables — may include MySQL/topology credentials), /debug/vars (expvar stats), and /debug/pprof/* if enabled.

The bug was introduced before v20.0.0 (long-standing) and was silently fixed in commit 3140c1846c (merged 2026-06-09, PR #20255, "tabletserver: escape reflected form values in twopcz handler"). The fix replaces fmt.Fprintln(w, msg) with fmt.Fprintln(w, html.EscapeString(msg)). No released version of Vitess contains the fix — the fix lives only on main (current tip 33a3c0fafe69, 2026-06-23). There is no CVE, GHSA, or OSV entry for this specific bug (verified 2026-06-24 against GitHub Advisory Database, OSV.dev, and NVD).

Impact

Field	Value
Type	Reflected Cross-Site Scripting (XSS)
CVSS 3.1	`AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N` = 7.7 HIGH
Attack Vector	Network (vttablet HTTP port 15999, multiplexed with gRPC/MySQL)
Attack Complexity	Low (craft URL, send to operator)
Privileges Required	None (default `acl` policy is allow-all)
User Interaction	Required (operator must visit crafted URL)
Scope	Changed (XSS chain reaction to other vttablet debug endpoints)
Confidentiality	High (query text, env vars, expvar stats)
Integrity	None (XSS itself doesn't change state)
Availability	None (XSS itself doesn't disrupt service)

Affected versions (verified)

All released versions are vulnerable. The fix lives only on main:

Tag	Released	`twopcz.go` line 185	Status
v20.0.0	2024-06-27	`fmt.Fprintln(w, msg)`	BUGGY
v20.0.1 - v20.0.6	2024	`fmt.Fprintln(w, msg)`	BUGGY
v22.0.4	2026-02-27	`fmt.Fprintln(w, msg)`	BUGGY
v23.0.3, v23.0.4	2026-02 / 2026-05	`fmt.Fprintln(w, msg)`	BUGGY
v24.0.0, v24.0.1	2026-04 / 2026-05	`fmt.Fprintln(w, msg)`	BUGGY
main (`33a3c0fafe69`)	2026-06-23	`fmt.Fprintln(w, html.EscapeString(msg))`	FIXED

Sensitive data exposed via the same-origin XSS chain

A successful XSS lands in the vttablet's origin. From there, the attacker can fetch (via fetch() from injected JavaScript) the following same-origin endpoints, all of which are unauthenticated by default:

/twopcz — in-flight 2PC transactions (query text, parameters, dtid)
/queryz — live query plans
/querylogz — recent queries with bound values
/txlogz — transactions
/debug/env — environment variables (may include MySQL creds, topology credentials, encryption keys)
/debug/vars — expvar stats
/debug/pprof/* — CPU/memory profiles (if enabled)

Reproduction (independent, runnable PoC)

The PoC is a self-contained Go HTTP server that replicates the buggy twopczHandler from Vitess v20.0.0 verbatim (using the same line-185 code). It runs on 127.0.0.1:15080 and returns the same response shape as the real Vitess endpoint.

# 1) Build the PoC (Go 1.23+)
cd /path/to/finding/CVE-pending-twopcz-xss
go build -o /tmp/vitess-twopcz-poc ./poc.go

# 2) Start the buggy server
ADDR=127.0.0.1:15080 /tmp/vitess-twopcz-poc &

# 3) Reproduce — Test 1: bare GET (no params)
curl -sS -i "http://127.0.0.1:15080/twopcz"
# → Content-Type: text/html; charset=utf-8, status 200

# 4) Test 2: XSS via Action param (URL-encode the script tag)
curl -sS -i "http://127.0.0.1:15080/twopcz?Action=%3Cscript%3Ealert(1)%3C%2Fscript%3E&dtid=zz"
# → Response body contains literal "<script>alert(1)</script>(zz): completed."
# → Browser executes the script as same-origin code

# 5) Test 3: XSS via dtid param (attribute-context payload)
curl -sS -i "http://127.0.0.1:15080/twopcz?Action=Demo&dtid=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E"
# → Response body contains literal "<img src=x onerror=alert(1)>"
# → Browser fires the onerror handler as same-origin code

# 6) Run the 3x automated runner (writes evidence/run-{1,2,3}.log)
bash ./poc/run.sh

PoC result excerpt (from evidence/run-1.log):

--- Test 2: XSS via Action=<script>alert(1)</script> ---
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
...
<h2>WARNING: Actions on this page can jeopardize data integrity.</h2>
<script>alert(1)</script>(zz): completed.

PASS: payload reflected UNESCAPED (XSS exploitable in browser)

The PoC was run 3 times on the buggy server (all 3/3 PASS) and the same code is byte-identical to the v20.0.0 commit 8aeb274f6c8e line 185.

Root cause (technical detail)

go/vt/vttablet/tabletserver/twopcz.go (v20.0.0 through v24.0.1):

// Line 185
fmt.Fprintln(w, msg)

msg is constructed earlier in the handler as:

msg := fmt.Sprintf("%s(%s): completed.", action, dtid)

with action and dtid coming from the form values r.FormValue("Action") and r.FormValue("dtid"). The form values are URL-decoded (so a + becomes a space, %3C becomes <) but never HTML-escaped. The handler explicitly sets Content-Type: text/html; charset=utf-8 (via the <!DOCTYPE html> it writes first), so the browser executes any injected <script> or attribute-context payload.

The fix in main (fmt.Fprintln(w, html.EscapeString(msg))) closes the hole by HTML-escaping both action and dtid before reflection.

Suggested fix (already in main)

// Recommended minimal patch (already in main, needs backport to all release branches):
import "html"

func twopczHandler(w http.ResponseWriter, r *http.Request) {
    // ... existing logic ...
    msg := fmt.Sprintf("%s(%s): completed.", action, dtid)
    fmt.Fprintln(w, html.EscapeString(msg))  // ← was: fmt.Fprintln(w, msg)
}

Backport the fix to v20.0.x, v22.0.x, v23.0.x, and v24.0.x as patch releases. The fix is one line and a one-line import "html" addition, so the backport risk is minimal.

Workaround / mitigation (no patch available)

If you cannot upgrade to a fixed release immediately:

Restrict the vttablet HTTP port (default 15999) to localhost only. vttablet can run with --tablet-allow-stats=false and --tablet-grpc-port configured separately from the HTTP port, or you can firewall the HTTP port at the network layer. The debug endpoints are not needed by production traffic.
Set a non-default ACL policy. Vitess supports an acl policy that defaults to allow-all. Setting it to a JSON file that denies unauthenticated access to debug endpoints (see go/acl/acl.go::savePolicy) would block the XSS, but the default policy is currently "" (allow-all) and many users don't override it.
Use a reverse proxy (nginx, envoy) in front of the vttablet HTTP port with a strict allowlist of clients.

Cross-references

The bug is not related to:
- CVE-2024-53257 (/debug/querylogz HTML injection, fixed in v20.0.4 — different endpoint)
- CVE-2026-27969 (backup MANIFEST path traversal)
- CVE-2026-27965 / GHSA-8g8j-r87h-p36x (backup external decompressor RCE)
PR #20255 is the fix commit; PR #19486 (defense-in-depth) is a separate hardening change

Contact

GitHub: @xylove21

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "vitess.io/vitess"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "vitess.io/vitess"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.24.0"
            },
            {
              "fixed": "0.24.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-104252"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-15T20:16:29Z",
    "nvd_published_at": "2026-10-13T20:17:12Z",
    "severity": "CRITICAL"
  },
  "details": "From: xylove21\nTo: security@vitess.io\nSubject: [Security Report] Vitess vttablet /twopcz reflected XSS\nDate: Tue, 24 Jun 2026 14:30:00 +0800\n\n## Summary\n\nThe `twopczHandler` in\n`go/vt/vttablet/tabletserver/twopcz.go` (line 185) reflects the `Action`\nand `dtid` form values directly into the HTML response body via\n`fmt.Fprintln(w, msg)` \u2014 **without HTML escaping**. The response is served\nas `text/html; charset=utf-8`, and Vitess\u0027s default `acl` policy is\n**allow-all**, so the endpoint is reachable by anyone who can hit the\nvttablet\u0027s HTTP port (default `15999`, multiplexed with gRPC and MySQL\nwire-protocol ports).\n\nA crafted `Action` or `dtid` value yields a **reflected XSS** that\nexecutes in the operator\u0027s browser with same-origin access to the\nvttablet\u0027s debug endpoints. This includes `/queryz` (live query plans),\n`/querylogz` (recent queries with bound values), `/txlogz` (transactions),\n`/debug/env` (environment variables \u2014 may include MySQL/topology\ncredentials), `/debug/vars` (expvar stats), and `/debug/pprof/*` if\nenabled.\n\nThe bug was introduced before v20.0.0 (long-standing) and was silently\nfixed in commit `3140c1846c` (merged 2026-06-09, PR #20255,\n\"tabletserver: escape reflected form values in twopcz handler\"). The\nfix replaces `fmt.Fprintln(w, msg)` with\n`fmt.Fprintln(w, html.EscapeString(msg))`. **No released version of\nVitess contains the fix** \u2014 the fix lives only on `main` (current tip\n`33a3c0fafe69`, 2026-06-23). There is **no CVE, GHSA, or OSV entry**\nfor this specific bug (verified 2026-06-24 against GitHub Advisory\nDatabase, OSV.dev, and NVD).\n\n## Impact\n\n| Field | Value |\n|-------|-------|\n| **Type** | Reflected Cross-Site Scripting (XSS) |\n| **CVSS 3.1** | `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N` = **7.7 HIGH** |\n| **Attack Vector** | Network (vttablet HTTP port 15999, multiplexed with gRPC/MySQL) |\n| **Attack Complexity** | Low (craft URL, send to operator) |\n| **Privileges Required** | None (default `acl` policy is allow-all) |\n| **User Interaction** | Required (operator must visit crafted URL) |\n| **Scope** | Changed (XSS chain reaction to other vttablet debug endpoints) |\n| **Confidentiality** | High (query text, env vars, expvar stats) |\n| **Integrity** | None (XSS itself doesn\u0027t change state) |\n| **Availability** | None (XSS itself doesn\u0027t disrupt service) |\n\n### Affected versions (verified)\n\nAll released versions are vulnerable. The fix lives only on `main`:\n\n| Tag | Released | `twopcz.go` line 185 | Status |\n|---|---|---|---|\n| v20.0.0 | 2024-06-27 | `fmt.Fprintln(w, msg)` | **BUGGY** |\n| v20.0.1 - v20.0.6 | 2024 | `fmt.Fprintln(w, msg)` | **BUGGY** |\n| v22.0.4 | 2026-02-27 | `fmt.Fprintln(w, msg)` | **BUGGY** |\n| v23.0.3, v23.0.4 | 2026-02 / 2026-05 | `fmt.Fprintln(w, msg)` | **BUGGY** |\n| v24.0.0, v24.0.1 | 2026-04 / 2026-05 | `fmt.Fprintln(w, msg)` | **BUGGY** |\n| **main** (`33a3c0fafe69`) | 2026-06-23 | `fmt.Fprintln(w, html.EscapeString(msg))` | **FIXED** |\n\n### Sensitive data exposed via the same-origin XSS chain\n\nA successful XSS lands in the vttablet\u0027s origin. From there, the\nattacker can fetch (via `fetch()` from injected JavaScript) the\nfollowing same-origin endpoints, all of which are unauthenticated by\ndefault:\n\n- `/twopcz` \u2014 in-flight 2PC transactions (query text, parameters, dtid)\n- `/queryz` \u2014 live query plans\n- `/querylogz` \u2014 recent queries with bound values\n- `/txlogz` \u2014 transactions\n- `/debug/env` \u2014 environment variables (may include MySQL creds, topology\n  credentials, encryption keys)\n- `/debug/vars` \u2014 expvar stats\n- `/debug/pprof/*` \u2014 CPU/memory profiles (if enabled)\n\n## Reproduction (independent, runnable PoC)\n\nThe PoC is a self-contained Go HTTP server that replicates the buggy\n`twopczHandler` from Vitess v20.0.0 verbatim (using the same line-185\ncode). It runs on `127.0.0.1:15080` and returns the same response shape\nas the real Vitess endpoint.\n\n```bash\n# 1) Build the PoC (Go 1.23+)\ncd /path/to/finding/CVE-pending-twopcz-xss\ngo build -o /tmp/vitess-twopcz-poc ./poc.go\n\n# 2) Start the buggy server\nADDR=127.0.0.1:15080 /tmp/vitess-twopcz-poc \u0026\n\n# 3) Reproduce \u2014 Test 1: bare GET (no params)\ncurl -sS -i \"http://127.0.0.1:15080/twopcz\"\n# \u2192 Content-Type: text/html; charset=utf-8, status 200\n\n# 4) Test 2: XSS via Action param (URL-encode the script tag)\ncurl -sS -i \"http://127.0.0.1:15080/twopcz?Action=%3Cscript%3Ealert(1)%3C%2Fscript%3E\u0026dtid=zz\"\n# \u2192 Response body contains literal \"\u003cscript\u003ealert(1)\u003c/script\u003e(zz): completed.\"\n# \u2192 Browser executes the script as same-origin code\n\n# 5) Test 3: XSS via dtid param (attribute-context payload)\ncurl -sS -i \"http://127.0.0.1:15080/twopcz?Action=Demo\u0026dtid=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E\"\n# \u2192 Response body contains literal \"\u003cimg src=x onerror=alert(1)\u003e\"\n# \u2192 Browser fires the onerror handler as same-origin code\n\n# 6) Run the 3x automated runner (writes evidence/run-{1,2,3}.log)\nbash ./poc/run.sh\n```\n\nPoC result excerpt (from `evidence/run-1.log`):\n\n```\n--- Test 2: XSS via Action=\u003cscript\u003ealert(1)\u003c/script\u003e ---\nHTTP/1.1 200 OK\nContent-Type: text/html; charset=utf-8\n...\n\u003ch2\u003eWARNING: Actions on this page can jeopardize data integrity.\u003c/h2\u003e\n\u003cscript\u003ealert(1)\u003c/script\u003e(zz): completed.\n\nPASS: payload reflected UNESCAPED (XSS exploitable in browser)\n```\n\nThe PoC was run 3 times on the buggy server (all 3/3 PASS) and the same\ncode is byte-identical to the v20.0.0 commit `8aeb274f6c8e` line 185.\n\n## Root cause (technical detail)\n\n`go/vt/vttablet/tabletserver/twopcz.go` (v20.0.0 through v24.0.1):\n\n```go\n// Line 185\nfmt.Fprintln(w, msg)\n```\n\n`msg` is constructed earlier in the handler as:\n\n```go\nmsg := fmt.Sprintf(\"%s(%s): completed.\", action, dtid)\n```\n\nwith `action` and `dtid` coming from the form values\n`r.FormValue(\"Action\")` and `r.FormValue(\"dtid\")`. The form values are\nURL-decoded (so a `+` becomes a space, `%3C` becomes `\u003c`) but never\nHTML-escaped. The handler explicitly sets `Content-Type: text/html;\ncharset=utf-8` (via the `\u003c!DOCTYPE html\u003e` it writes first), so the\nbrowser executes any injected `\u003cscript\u003e` or attribute-context payload.\n\nThe fix in main (`fmt.Fprintln(w, html.EscapeString(msg))`) closes the\nhole by HTML-escaping both `action` and `dtid` before reflection.\n\n## Suggested fix (already in main)\n\n```go\n// Recommended minimal patch (already in main, needs backport to all release branches):\nimport \"html\"\n\nfunc twopczHandler(w http.ResponseWriter, r *http.Request) {\n    // ... existing logic ...\n    msg := fmt.Sprintf(\"%s(%s): completed.\", action, dtid)\n    fmt.Fprintln(w, html.EscapeString(msg))  // \u2190 was: fmt.Fprintln(w, msg)\n}\n```\n\nBackport the fix to v20.0.x, v22.0.x, v23.0.x, and v24.0.x as patch\nreleases. The fix is one line and a one-line `import \"html\"` addition,\nso the backport risk is minimal.\n\n## Workaround / mitigation (no patch available)\n\nIf you cannot upgrade to a fixed release immediately:\n\n1. **Restrict the vttablet HTTP port** (default 15999) to localhost\n   only. vttablet can run with `--tablet-allow-stats=false` and\n   `--tablet-grpc-port` configured separately from the HTTP port, or\n   you can firewall the HTTP port at the network layer. The debug\n   endpoints are not needed by production traffic.\n\n2. **Set a non-default ACL policy**. Vitess supports an `acl` policy\n   that defaults to allow-all. Setting it to a JSON file that denies\n   unauthenticated access to debug endpoints (see\n   `go/acl/acl.go::savePolicy`) would block the XSS, but the default\n   policy is currently `\"\"` (allow-all) and many users don\u0027t override\n   it.\n\n3. **Use a reverse proxy** (nginx, envoy) in front of the vttablet\n   HTTP port with a strict allowlist of clients.\n\n## Cross-references\n\n  - The bug is **not** related to:\n    - CVE-2024-53257 (`/debug/querylogz` HTML injection, fixed in\n      v20.0.4 \u2014 different endpoint)\n    - CVE-2026-27969 (backup MANIFEST path traversal)\n    - CVE-2026-27965 / GHSA-8g8j-r87h-p36x (backup external decompressor\n      RCE)\n  - PR #20255 is the fix commit; PR #19486 (defense-in-depth) is a\n    separate hardening change\n\n## Contact\n\n  - GitHub: @xylove21",
  "id": "GHSA-v75v-6fpf-gvw8",
  "modified": "2026-10-15T20:16:29Z",
  "published": "2026-10-15T20:16:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104252"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/pull/20255"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/pull/20273"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/pull/20274"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitessio/vitess"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/releases/tag/v23.0.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/releases/tag/v24.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vitess vttablet /twopcz reflected XSS"
}

GHSA-V7CH-CX27-643J

Vulnerability from github – Published: 2023-04-11 18:30 – Updated: 2024-04-04 03:24

Details

An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-35850"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-11T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the \"reset-password\" page.",
  "id": "GHSA-v7ch-cx27-643j",
  "modified": "2024-04-04T03:24:22Z",
  "published": "2023-04-11T18:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35850"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/psirt/FG-IR-22-275"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VF6X-59HH-332F

Vulnerability from github – Published: 2025-03-01 00:11 – Updated: 2026-02-18 23:47

Summary

Formwork has a cross-site scripting (XSS) vulnerability in Site title

Details

Summary

The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.

Impact

The attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.

Patches

Formwork 2.x (aa3e9c6) escapes site title from panel header navigation.

Details

By embedding "<!--", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.

Severity

4.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getformwork/formwork"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-beta.3"
            },
            {
              "fixed": "2.0.0-beta.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.0-beta.3"
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-01T00:11:46Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.\n\n### Impact\n\nThe attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.\n\n### Patches\n- [**Formwork 2.x** (aa3e9c6)](https://github.com/getformwork/formwork/commit/aa3e9c684035d9e8495169fde7c57d97faa3f9a2) escapes site title from panel header navigation.\n\n### Details\n\nBy embedding \"\u003c!--\", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.",
  "id": "GHSA-vf6x-59hh-332f",
  "modified": "2026-02-18T23:47:22Z",
  "published": "2025-03-01T00:11:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getformwork/formwork/security/advisories/GHSA-vf6x-59hh-332f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getformwork/formwork/commit/aa3e9c684035d9e8495169fde7c57d97faa3f9a2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getformwork/formwork"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Formwork has a cross-site scripting (XSS) vulnerability in Site title"
}

GHSA-VF9V-CP45-WPQ2

Vulnerability from github – Published: 2024-06-04 12:31 – Updated: 2024-06-04 12:31

Details

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affects ARI Stream Quiz: from n/a through 1.3.2.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-47513"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-04T10:15:11Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affects ARI Stream Quiz: from n/a through 1.3.2.",
  "id": "GHSA-vf9v-cp45-wpq2",
  "modified": "2024-06-04T12:31:03Z",
  "published": "2024-06-04T12:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47513"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/ari-stream-quiz/wordpress-ari-stream-quiz-wordpress-quizzes-builder-plugin-1-2-32-content-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VG46-2RRJ-3647

Vulnerability from github – Published: 2022-10-26 22:08 – Updated: 2025-11-04 16:39

Summary

Twisted vulnerable to NameVirtualHost Host header injection

Details

When the host header does not match a configured host, twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.

Example configuration:

from twisted.web.server import Site
from twisted.web.vhost import NameVirtualHost
from twisted.internet import reactor

resource = NameVirtualHost()
site = Site(resource)
reactor.listenTCP(8080, site)
reactor.run()

Output:

❯ curl -H"Host:<h1>HELLO THERE</h1>" http://localhost:8080/

<html>
  <head><title>404 - No Such Resource</title></head>
  <body>
    <h1>No Such Resource</h1>
    <p>host b'<h1>hello there</h1>' not in vhost map</p>
  </body>
</html>

This vulnerability was introduced in f49041bb67792506d85aeda9cf6157e92f8048f4 and first appeared in the 0.9.4 release.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Twisted"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.4"
            },
            {
              "fixed": "22.10.0rc1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-39348"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-26T22:08:39Z",
    "nvd_published_at": "2022-10-26T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "When the host header does not match a configured host, `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.\n\nExample configuration:\n```python\nfrom twisted.web.server import Site\nfrom twisted.web.vhost import NameVirtualHost\nfrom twisted.internet import reactor\n\nresource = NameVirtualHost()\nsite = Site(resource)\nreactor.listenTCP(8080, site)\nreactor.run()\n```\nOutput:\n```\n\u276f curl -H\"Host:\u003ch1\u003eHELLO THERE\u003c/h1\u003e\" http://localhost:8080/\n\n\u003chtml\u003e\n  \u003chead\u003e\u003ctitle\u003e404 - No Such Resource\u003c/title\u003e\u003c/head\u003e\n  \u003cbody\u003e\n    \u003ch1\u003eNo Such Resource\u003c/h1\u003e\n    \u003cp\u003ehost b\u0027\u003ch1\u003ehello there\u003c/h1\u003e\u0027 not in vhost map\u003c/p\u003e\n  \u003c/body\u003e\n\u003c/html\u003e\n```\n\nThis vulnerability was introduced in f49041bb67792506d85aeda9cf6157e92f8048f4 and first appeared in the 0.9.4 release.",
  "id": "GHSA-vg46-2rrj-3647",
  "modified": "2025-11-04T16:39:47Z",
  "published": "2022-10-26T22:08:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39348"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/twisted/twisted"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00038.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202301-02"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Twisted vulnerable to NameVirtualHost Host header injection"
}

GHSA-VGF7-QRG3-CM45

Vulnerability from github – Published: 2026-01-15 18:31 – Updated: 2026-01-15 18:31

Details

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.

This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.

Severity

4.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-20047"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-15T17:16:07Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.\n\nThis vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.",
  "id": "GHSA-vgf7-qrg3-cm45",
  "modified": "2026-01-15T18:31:33Z",
  "published": "2026-01-15T18:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20047"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-964cdxW5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VHG6-M6C8-39C2

Vulnerability from github – Published: 2025-04-01 15:31 – Updated: 2025-04-03 00:31

Details

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.19.

Users are recommended to upgrade to version 18.12.19, which fixes the issue.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-30676"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-01T15:16:07Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: before 18.12.19.\n\nUsers are recommended to upgrade to version 18.12.19, which fixes the issue.",
  "id": "GHSA-vhg6-m6c8-39c2",
  "modified": "2025-04-03T00:31:32Z",
  "published": "2025-04-01T15:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30676"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/OFBIZ-13219"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/8d718qt8dqthnw1gmyxsq8glfdjklnjf"
    },
    {
      "type": "WEB",
      "url": "https://ofbiz.apache.org/download.html"
    },
    {
      "type": "WEB",
      "url": "https://ofbiz.apache.org/security.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/04/01/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VJHQ-XQVQ-7GH3

Vulnerability from github – Published: 2024-12-05 06:30 – Updated: 2024-12-05 06:30

Details

HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.

Severity

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-42195"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-05T05:15:06Z",
    "severity": "LOW"
  },
  "details": "HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.",
  "id": "GHSA-vjhq-xqvq-7gh3",
  "modified": "2024-12-05T06:30:43Z",
  "published": "2024-12-05T06:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42195"
    },
    {
      "type": "WEB",
      "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0117908"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VM4M-6MF9-8885

Vulnerability from github – Published: 2024-04-05 15:30 – Updated: 2024-04-05 15:30

Details

Stored XSS in graph rendering in Checkmk <2.3.0b4.

Severity

4.6 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-2380"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-05T13:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Stored XSS in graph rendering in Checkmk \u003c2.3.0b4.",
  "id": "GHSA-vm4m-6mf9-8885",
  "modified": "2024-04-05T15:30:30Z",
  "published": "2024-04-05T15:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2380"
    },
    {
      "type": "WEB",
      "url": "https://checkmk.com/werk/16618"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation

Implementation

Carefully check each input parameter against a rigorous positive specification (allowlist) defining the specific characters and format allowed. All input should be neutralized, not just parameters that the user is supposed to specify, but all data in the request, including hidden fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing XSS vulnerabilities is to validate only fields that are expected to be redisplayed by the site. We often encounter data from the request that is reflected by the application server or the application that the development team did not anticipate. Also, a field that is not currently reflected may be used by a future developer. Therefore, validating ALL parts of the HTTP request is recommended.

Mitigation MIT-30.1

Implementation

Strategy: Output Encoding

Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are inconsistent, the downstream component might treat some character or byte sequences as special, even if they are not special in the original encoding. Attackers might then be able to exploit this discrepancy and conduct injection attacks; they even might be able to bypass protection mechanisms that assume the original encoding is also being used by the downstream component.
The problem of inconsistent output encodings often arises in web pages. If an encoding is not specified in an HTTP header, web browsers often guess about which encoding is being used. This can open up the browser to subtle XSS attacks.

Mitigation MIT-43

Implementation

With Struts, write all data from form beans with the bean's filter attribute set to true.

Mitigation MIT-31

Implementation

Strategy: Attack Surface Reduction

To help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible to malicious client-side scripts that use document.cookie. This is not a complete solution, since HttpOnly is not supported by all browsers. More importantly, XmlHttpRequest and other powerful browser technologies provide read access to HTTP headers, including the Set-Cookie header in which the HttpOnly flag is set.

CAPEC-18: XSS Targeting Non-Script Elements

This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an adversary to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote adversary to collect and interpret the output of said attack.

CAPEC-193: PHP Remote File Inclusion

In this pattern the adversary is able to load and execute arbitrary code remotely available from the application. This is usually accomplished through an insecurely configured PHP runtime environment and an improperly sanitized "include" or "require" call, which the user can then control to point to any web-accessible file. This allows adversaries to hijack the targeted application and force it to execute their own instructions.

CAPEC-32: XSS Through HTTP Query Strings

An adversary embeds malicious script code in the parameters of an HTTP query string and convinces a victim to submit the HTTP request that contains the query string to a vulnerable web application. The web application then procedes to use the values parameters without properly validation them first and generates the HTML code that will be executed by the victim's browser.

CAPEC-86: XSS Through HTTP Headers

An adversary exploits web applications that generate web content, such as links in a HTML page, based on unvalidated or improperly validated data submitted by other actors. XSS in HTTP Headers attacks target the HTTP headers which are hidden from most users and may not be validated by web applications.

← Back to the CWE list