CVE-2026-65901

Publié : 23 juillet 2026

Modifié : 23 juillet 2026

Score CVSS

6.1

MEDIUM

Description détaillée

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Références et Patchs

https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4 https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4

Dernières Vulnérabilités

CVE-2026-65761

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.

VOIR DÉTAILS

CVE-2026-65760

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.

VOIR DÉTAILS

CVE-2026-65759

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary orders.

VOIR DÉTAILS