https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-24T17:12:19.708715+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111713 CVE-2026-111713 — tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch 2026-10-24T17:12:19.711453+00:00

Affected: AmauriC tarteaucitron.js

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.