https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 14:10:50 +0000 https://db.gcve.eu/vuln/cve-2026-95659 <p><strong>Affected:</strong> MISP</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> <p><strong>Affected:</strong> MISP</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> https://db.gcve.eu/vuln/cve-2026-95659