https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:03:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-211225 EUVD-2026-211225 https://cve.radiocsirt.org/vuln/euvd-2026-211225 https://cve.radiocsirt.org/vuln/fkie_cve-2021-46888 <p>An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.</p> <p>An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-46888 https://cve.radiocsirt.org/vuln/ghsa-9fcq-h23h-rxhx <p>An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.</p> <p>An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.</p> https://cve.radiocsirt.org/vuln/ghsa-9fcq-h23h-rxhx https://cve.radiocsirt.org/vuln/gsd-2021-46888 gsd-2021-46888 https://cve.radiocsirt.org/vuln/gsd-2021-46888 https://cve.radiocsirt.org/vuln/hsec-2023-0008 <p><strong>Affected:</strong> Hackage: hledger-web</p> <p># Stored XSS in *hledger-web*</p> <p>An issue was discovered in *hledger-web* &lt; 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in `toBloodhoundJson` that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the `atob` function.</p> <p>*hledger-web* forms sanitise obvious JavaScript, but not obfuscated JavaScript (see [OWASP Filter Evasion Cheat Sheet][cheatsheet]). This means *hledger-web* instances, especially anonymously-writable ones like `demo.hledger.org`, could be loaded with malicious JavaScript to be executed by subsequent visitors.</p> <p>[cheatsheet]: https://owasp.org/www-community/xss-filter-evasion-cheatsheet</p> <p>Reported by Gaspard Baye and Hamidullah Muslih. Fix by Arsen Arsenović.</p> <p><strong>Affected:</strong> Hackage: hledger-web</p> <p># Stored XSS in *hledger-web*</p> <p>An issue was discovered in *hledger-web* &lt; 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in `toBloodhoundJson` that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the `atob` function.</p> <p>*hledger-web* forms sanitise obvious JavaScript, but not obfuscated JavaScript (see [OWASP Filter Evasion Cheat Sheet][cheatsheet]). This means *hledger-web* instances, especially anonymously-writable ones like `demo.hledger.org`, could be loaded with malicious JavaScript to be executed by subsequent visitors.</p> <p>[cheatsheet]: https://owasp.org/www-community/xss-filter-evasion-cheatsheet</p> <p>Reported by Gaspard Baye and Hamidullah Muslih. Fix by Arsen Arsenović.</p> https://cve.radiocsirt.org/vuln/hsec-2023-0008