https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:20:55 +0000 https://db.gcve.eu/vuln/cve-2026-85227 <p><strong>Affected:</strong> misp</p> <p>MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a &lt;script&gt; element.</p> <p>Because JsonTool::encode() uses JSON_UNESCAPED_SLASHES, an attacker-controlled value containing a closing &lt;/script&gt; sequence could terminate the surrounding script element and inject arbitrary HTML or JavaScript. For example, a specially crafted viewEventAttributes URL could contain malicious content in one of the affected filter parameters.</p> <p>An attacker could exploit the vulnerability by convincing an authenticated MISP user to follow a crafted URL. Successful exploitation would execute attacker-controlled JavaScript in the security context of the MISP instance and with the privileges of the victim&#39;s authenticated browser session. This could allow access to information available to the victim, modification of data through authenticated requests, or other actions permitted by the victim&#39;s MISP permissions.</p> <p>The vulnerability is addressed by applying HTML escaping with h() to both scalar and array values before they are inserted into the DOM.</p> <p><strong>Affected:</strong> misp</p> <p>MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a &lt;script&gt; element.</p> <p>Because JsonTool::encode() uses JSON_UNESCAPED_SLASHES, an attacker-controlled value containing a closing &lt;/script&gt; sequence could terminate the surrounding script element and inject arbitrary HTML or JavaScript. For example, a specially crafted viewEventAttributes URL could contain malicious content in one of the affected filter parameters.</p> <p>An attacker could exploit the vulnerability by convincing an authenticated MISP user to follow a crafted URL. Successful exploitation would execute attacker-controlled JavaScript in the security context of the MISP instance and with the privileges of the victim&#39;s authenticated browser session. This could allow access to information available to the victim, modification of data through authenticated requests, or other actions permitted by the victim&#39;s MISP permissions.</p> <p>The vulnerability is addressed by applying HTML escaping with h() to both scalar and array values before they are inserted into the DOM.</p> https://db.gcve.eu/vuln/cve-2026-85227