https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 13:38:49 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-103662 <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).</p> <p>The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator&#39;s browser session.</p> <p>Preconditions:</p> <p>- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.</p> <p>- The victim must be an authenticated site administrator.</p> <p>- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).</p> <p>Security impact:</p> <p>- Execution of arbitrary client-side script in the context of the administrator&#39;s browser.</p> <p>- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.</p> <p>- Potential for performing privileged actions on behalf of the administrator within the MISP interface.</p> <p>Affected versions: &lt;2.5.48.</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).</p> <p>The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator&#39;s browser session.</p> <p>Preconditions:</p> <p>- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.</p> <p>- The victim must be an authenticated site administrator.</p> <p>- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).</p> <p>Security impact:</p> <p>- Execution of arbitrary client-side script in the context of the administrator&#39;s browser.</p> <p>- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.</p> <p>- Potential for performing privileged actions on behalf of the administrator within the MISP interface.</p> <p>Affected versions: &lt;2.5.48.</p> https://db.gcve.eu/vuln/fkie_cve-2026-103662 https://db.gcve.eu/vuln/gcve-1-2026-20300 <p><strong>Affected:</strong> MISP</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).</p> <p>The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator&#39;s browser session.</p> <p>Preconditions:</p> <p>- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.</p> <p>- The victim must be an authenticated site administrator.</p> <p>- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).</p> <p>Security impact:</p> <p>- Execution of arbitrary client-side script in the context of the administrator&#39;s browser.</p> <p>- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.</p> <p>- Potential for performing privileged actions on behalf of the administrator within the MISP interface.</p> <p>Affected versions: &lt;2.5.48.</p> <p><strong>Affected:</strong> MISP</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).</p> <p>The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator&#39;s browser session.</p> <p>Preconditions:</p> <p>- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.</p> <p>- The victim must be an authenticated site administrator.</p> <p>- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).</p> <p>Security impact:</p> <p>- Execution of arbitrary client-side script in the context of the administrator&#39;s browser.</p> <p>- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.</p> <p>- Potential for performing privileged actions on behalf of the administrator within the MISP interface.</p> <p>Affected versions: &lt;2.5.48.</p> https://db.gcve.eu/vuln/gcve-1-2026-20300 https://db.gcve.eu/vuln/ghsa-p9m5-xwgx-8j69 <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).</p> <p>The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator&#39;s browser session.</p> <p>Preconditions:</p> <p>- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.</p> <p>- The victim must be an authenticated site administrator.</p> <p>- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).</p> <p>Security impact:</p> <p>- Execution of arbitrary client-side script in the context of the administrator&#39;s browser.</p> <p>- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.</p> <p>- Potential for performing privileged actions on behalf of the administrator within the MISP interface.</p> <p>Affected versions: &lt;2.5.48.</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).</p> <p>The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site administrator to visit a crafted URL containing a malicious tag name parameter can execute arbitrary JavaScript in the administrator&#39;s browser session.</p> <p>Preconditions:</p> <p>- The target must be running a MISP instance with the legacy taxonomy tag confirmation views enabled.</p> <p>- The victim must be an authenticated site administrator.</p> <p>- The victim must navigate to the attacker-crafted URL (e.g., via a phishing link).</p> <p>Security impact:</p> <p>- Execution of arbitrary client-side script in the context of the administrator&#39;s browser.</p> <p>- Potential theft of session tokens, CSRF tokens, or other sensitive data accessible from the page.</p> <p>- Potential for performing privileged actions on behalf of the administrator within the MISP interface.</p> <p>Affected versions: &lt;2.5.48.</p> https://db.gcve.eu/vuln/ghsa-p9m5-xwgx-8j69