https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 09:55:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-366840 EUVD-2026-366840 https://cve.radiocsirt.org/vuln/euvd-2026-366840 https://cve.radiocsirt.org/vuln/fkie_cve-2026-89145 <p>Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users&#39; browsers when dependency validation fails.</p> <p>Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users&#39; browsers when dependency validation fails.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-89145 https://cve.radiocsirt.org/vuln/ghsa-gqrp-6638-7vpg <p>Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users&#39; browsers when dependency validation fails.</p> <p>Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users&#39; browsers when dependency validation fails.</p> https://cve.radiocsirt.org/vuln/ghsa-gqrp-6638-7vpg