https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 14:10:25 +0000 https://db.gcve.eu/vuln/cve-2026-100174 <p><strong>Affected:</strong> ail project ail framework</p> <p>The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers (e.g., &lt;img src=x onerror=alert(1)&gt; or &lt;svg onload=...&gt;) in the tag name. When another authenticated user opened a page containing the tag selector, the malicious tag name was inserted into the DOM using jQuery&#39;s html property, causing the embedded script to execute in the victim&#39;s browser context.</p> <p>The vulnerable code paths affected both the suggestion/combo-item rendering (_renderComboItems) and the selected-tag rendering logic. In both cases, the display value derived from the tag&#39;s displayField was passed directly to the html property of a jQuery element constructor, which parses and inserts the string as raw HTML rather than as text.</p> <p>Preconditions: the attacker must have an authenticated account with permission to create custom tags, and the victim must be an authenticated user who views a page that renders the tag selector with the attacker&#39;s stored tag. The attack is stored (persistent) and does not require the victim to perform any action beyond loading the page.</p> <p>Security impact: successful exploitation allows arbitrary JavaScript execution in the victim&#39;s browser within the application&#39;s origin, potentially leading to session hijacking, unauthorized data access, form manipulation, or further client-side attacks.</p> <p><strong>Affected:</strong> ail project ail framework</p> <p>The AIL Framework tag selector component (var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS). A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers (e.g., &lt;img src=x onerror=alert(1)&gt; or &lt;svg onload=...&gt;) in the tag name. When another authenticated user opened a page containing the tag selector, the malicious tag name was inserted into the DOM using jQuery&#39;s html property, causing the embedded script to execute in the victim&#39;s browser context.</p> <p>The vulnerable code paths affected both the suggestion/combo-item rendering (_renderComboItems) and the selected-tag rendering logic. In both cases, the display value derived from the tag&#39;s displayField was passed directly to the html property of a jQuery element constructor, which parses and inserts the string as raw HTML rather than as text.</p> <p>Preconditions: the attacker must have an authenticated account with permission to create custom tags, and the victim must be an authenticated user who views a page that renders the tag selector with the attacker&#39;s stored tag. The attack is stored (persistent) and does not require the victim to perform any action beyond loading the page.</p> <p>Security impact: successful exploitation allows arbitrary JavaScript execution in the victim&#39;s browser within the application&#39;s origin, potentially leading to session hijacking, unauthorized data access, form manipulation, or further client-side attacks.</p> https://db.gcve.eu/vuln/cve-2026-100174