https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 09:49:27 +0000 https://cve.radiocsirt.org/vuln/cve-2026-71249 <p><strong>Affected:</strong> 299Ko</p> <p>299Ko&#39;s public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine&#39;s variable output function (common/Template.php, _show_var) echoes values with no htmlspecialchars call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea.</p> <p><strong>Affected:</strong> 299Ko</p> <p>299Ko&#39;s public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine&#39;s variable output function (common/Template.php, _show_var) echoes values with no htmlspecialchars call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea.</p> https://cve.radiocsirt.org/vuln/cve-2026-71249