ByteOS Network

Vulnerability Details :

CVE-2026-28338

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-27 Feb, 2026 | 20:28

Updated At-27 Feb, 2026 | 20:28

PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:GitHub_M

Assigner Org ID:a0819718-46f1-4df5-94e2-005712e83aaa

Published At:27 Feb, 2026 | 20:28

Updated At:27 Feb, 2026 | 20:28

▼CVE Numbering Authority (CNA)

PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

Affected Products

Vendor

pmd

Product

pmd

Versions

Affected

< 7.22.0

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	6.8	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Version: 3.1

Base score: 6.8

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Hyperlink	Resource
https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r	x_refsource_CONFIRM
https://github.com/pmd/pmd/pull/6475	x_refsource_MISC
https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442	x_refsource_MISC

Hyperlink: https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r

Resource:

x_refsource_CONFIRM

Hyperlink: https://github.com/pmd/pmd/pull/6475

Resource:

x_refsource_MISC

Hyperlink: https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442

Resource:

x_refsource_MISC

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security-advisories@github.com

Published At:27 Feb, 2026 | 21:16

Updated At:27 Feb, 2026 | 21:16

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.8	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Type: Secondary

Version: 3.1

Base score: 6.8

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	security-advisories@github.com

CWE ID: CWE-79

Type: Primary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442	security-advisories@github.com	N/A
https://github.com/pmd/pmd/pull/6475	security-advisories@github.com	N/A
https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r	security-advisories@github.com	N/A

Hyperlink: https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442

Source: security-advisories@github.com

Resource: N/A

Hyperlink: https://github.com/pmd/pmd/pull/6475

Source: security-advisories@github.com

Resource: N/A

Hyperlink: https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r

Source: security-advisories@github.com

Resource: N/A

Similar CVEs

6Records found

CVE-2024-31137

Matching Score-4

Assigner-JetBrains s.r.o.

View Details

Matching Score-4

Assigner-JetBrains s.r.o.

CVSS Score-6.8||MEDIUM

EPSS-0.43% / 62.44%

7 Day CHG~0.00%

Published-28 Mar, 2024 | 15:07

Updated-02 Aug, 2024 | 01:46

In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration

Vendor-JetBrains s.r.o.

Product-teamcity TeamCity

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-28772

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.26% / 48.98%

7 Day CHG~0.00%

Published-25 Jul, 2024 | 17:18

Updated-02 Aug, 2024 | 19:52

IBM Security Directory Integrator cross-site scripting

IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 285645.

Vendor-IBM Corporation

Product-security_verify_access security_directory_integrator security_directory_server Security Directory Integrator Security Verify Directory Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-26251

Matching Score-4

Assigner-Microsoft Corporation

View Details

Matching Score-4

Assigner-Microsoft Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.39% / 59.82%

7 Day CHG~0.00%

Published-09 Apr, 2024 | 17:01

Updated-03 May, 2025 | 00:40

Microsoft SharePoint Server Spoofing Vulnerability

Vendor-Microsoft Corporation

Product-sharepoint_server Microsoft SharePoint Server Subscription Edition Microsoft SharePoint Server 2016 Microsoft SharePoint Server 2019

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-41117

Matching Score-4

Assigner-Grafana Labs

View Details

Matching Score-4

Assigner-Grafana Labs

CVSS Score-6.8||MEDIUM

EPSS-0.01% / 1.26%

7 Day CHG~0.00%

Published-12 Feb, 2026 | 08:49

Updated-26 Feb, 2026 | 22:20

XSS in Grafana Explore stack trace

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

Vendor-Grafana Labs

Product-grafana grafana/grafana-enterprise grafana/grafana

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-39205

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-6.8||MEDIUM

EPSS-0.29% / 51.48%

7 Day CHG~0.00%

Published-15 Sep, 2021 | 17:15

Updated-04 Aug, 2024 | 01:58

DOM-based XSS/Content Spoofing via Prototype Pollution

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.

Vendor-8x8 jitsi

Product-jitsi_meet jitsi-meet

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVE-2021-29484

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-6.8||MEDIUM

EPSS-82.00% / 99.18%

7 Day CHG~0.00%

Published-29 Apr, 2021 | 20:35

Updated-03 Aug, 2024 | 22:11

DOM XSS in Theme Preview

Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.3.2. Immediate action should be taken to secure your site. The issue has been fixed in 4.3.3, all 4.x sites should upgrade as soon as possible. As the endpoint is unused, the patch simply removes it. As a workaround blocking access to /ghost/preview can also mitigate the issue.

Vendor-ghost TryGhost

Product-ghost Ghost

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-28338

Credits

PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs