https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 00:12:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267784 EUVD-2026-267784 https://cve.radiocsirt.org/vuln/euvd-2026-267784 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25496 <p>Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users&#39; profiles. This issue is patched in versions 4.16.18 and 5.8.22.</p> <p>Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users&#39; profiles. This issue is patched in versions 4.16.18 and 5.8.22.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25496 https://cve.radiocsirt.org/vuln/ghsa-9f5h-mmq6-2x78 <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>## Summary</p> <p>A stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the `|md|raw` Twig filter without proper escaping, allowing script execution when the Number field is displayed on users&#39; profiles.</p> <p>## Proof of Concept</p> <p>### Required Permissions</p> <p>- Administrator access - `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).</p> <p>### Steps to Reproduce 1. Log in with an admin account 2. Navigate to **Settings** → **Fields** → **New field** 3. Choose **Number** as the field type 4. Set the **Prefix/Suffix Text** field to: &lt;img width=&#34;611&#34; height=&#34;908&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/63766ca4-4fa9-490b-8bea-37364137527d&#34; /&gt; ```html &lt;img src=x onerror=&#34;alert(&#39;Number Prefix/Suffix XSS&#39;)&#34; hidden&gt; ``` 5. Save the field 6. Add this field to any element (e.g., User Profile fields via **Settings** → **Users** → **User Fields**) 7. Navigate to your account (`/admin/myaccount`) or any user profile (`/admin/users/{id}`) 8. XSS executes when viewing the form &lt;img width=&#34;1246&#34; height=&#34;677&#34; alt=&#34;image-1&#34; src=&#34;https://github.com/user-attachments/assets/dafeb2b7-905f-4a4b-b3d6-1c16a905498f&#34; /&gt;</p> <p>## Mitigation Sanitize prefix/suffix before rendering or use `|e` filter instead of `|raw`.</p> <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>## Summary</p> <p>A stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the `|md|raw` Twig filter without proper escaping, allowing script execution when the Number field is displayed on users&#39; profiles.</p> <p>## Proof of Concept</p> <p>### Required Permissions</p> <p>- Administrator access - `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).</p> <p>### Steps to Reproduce 1. Log in with an admin account 2. Navigate to **Settings** → **Fields** → **New field** 3. Choose **Number** as the field type 4. Set the **Prefix/Suffix Text** field to: &lt;img width=&#34;611&#34; height=&#34;908&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/63766ca4-4fa9-490b-8bea-37364137527d&#34; /&gt; ```html &lt;img src=x onerror=&#34;alert(&#39;Number Prefix/Suffix XSS&#39;)&#34; hidden&gt; ``` 5. Save the field 6. Add this field to any element (e.g., User Profile fields via **Settings** → **Users** → **User Fields**) 7. Navigate to your account (`/admin/myaccount`) or any user profile (`/admin/users/{id}`) 8. XSS executes when viewing the form &lt;img width=&#34;1246&#34; height=&#34;677&#34; alt=&#34;image-1&#34; src=&#34;https://github.com/user-attachments/assets/dafeb2b7-905f-4a4b-b3d6-1c16a905498f&#34; /&gt;</p> <p>## Mitigation Sanitize prefix/suffix before rendering or use `|e` filter instead of `|raw`.</p> https://cve.radiocsirt.org/vuln/ghsa-9f5h-mmq6-2x78