https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:29:31 +0000 https://cve.radiocsirt.org/vuln/cve-2026-46516 <p><strong>Affected:</strong> mwtcmi frogman</p> <p>Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman&#39;s chat-console markdown formatter (`assets/js/chat.js`&#39;s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer&#39;s session, with the viewer&#39;s permissions. FreePBX&#39;s own admin GUI escapes these same fields via `freepbx_htmlspecialchars()` throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue.</p> <p><strong>Affected:</strong> mwtcmi frogman</p> <p>Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman&#39;s chat-console markdown formatter (`assets/js/chat.js`&#39;s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer&#39;s session, with the viewer&#39;s permissions. FreePBX&#39;s own admin GUI escapes these same fields via `freepbx_htmlspecialchars()` throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-46516