https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 17:34:03 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-264545 EUVD-2026-264545 https://cve.radiocsirt.org/vuln/euvd-2026-264545 https://cve.radiocsirt.org/vuln/fkie_cve-2025-65442 <p>DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted &#34;wvstest&#34; parameter in the URL or malicious script injection into window.localStorage. The vulnerability arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3&#39;s v-html directive without sanitization. Even if modern browsers&#39; built-in XSS filters block pop-up alerts, attackers can use concealed payloads to bypass interception and achieve actual harm.</p> <p>DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted &#34;wvstest&#34; parameter in the URL or malicious script injection into window.localStorage. The vulnerability arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3&#39;s v-html directive without sanitization. Even if modern browsers&#39; built-in XSS filters block pop-up alerts, attackers can use concealed payloads to bypass interception and achieve actual harm.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-65442 https://cve.radiocsirt.org/vuln/ghsa-6c3p-2cc4-9r7p <p>DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted &#34;wvstest&#34; parameter in the URL or malicious script injection into window.localStorage. The vulnerability arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3&#39;s v-html directive without sanitization. Even if modern browsers&#39; built-in XSS filters block pop-up alerts, attackers can use concealed payloads to bypass interception and achieve actual harm.</p> <p>DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted &#34;wvstest&#34; parameter in the URL or malicious script injection into window.localStorage. The vulnerability arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3&#39;s v-html directive without sanitization. Even if modern browsers&#39; built-in XSS filters block pop-up alerts, attackers can use concealed payloads to bypass interception and achieve actual harm.</p> https://cve.radiocsirt.org/vuln/ghsa-6c3p-2cc4-9r7p