Most recent entries from all

EUVD-2026-325754

2026-10-03T15:53:57.311410+00:00

EUVD-2026-325754

fkie_cve-2026-42224

2026-10-03T15:53:57.311446+00:00

ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.

GHSA-55wf-5m3q-6jjf — ipl/web is vulnerable to reflected XSS by malformed search requests

2026-10-03T15:53:57.311480+00:00

Affected: Packagist: ipl/web

### Impact The vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing.

### Patches Version 0.13.1 includes a fix for this. It will be published as part of `icinga-php-library` version 0.19.2.

### Workarounds Enable the Content-Security-Policy (CSP) in the general configuration of Icinga Web available since version 2.12.0.

### References None

openSUSE-SU-2026:10693-1 — icinga-php-library-0.19.2-1.1 on GA media

2026-10-03T15:53:57.311512+00:00

icinga-php-library-0.19.2-1.1 on GA media