Approved changes feed: RSS · Atom
cpe:2.3:a:pmd_project:pmd:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Pmd Project (a0ae4329-3300-5c49-8bc0-39bb8d7def40) |
|---|---|
| Product | Pmd (69a1c548-c588-590b-b720-51206511e06b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pmd/pmd |
purl2cpe | 2026-06-01 10:14:51.659559 |
pkg:maven/net.sourceforge.pmd/pmd |
purl2cpe | 2026-06-01 10:14:51.659563 |
pkg:maven/pmd/pmd |
purl2cpe | 2026-06-01 10:14:51.659566 |
pkg:sourceforge/pmd |
purl2cpe | 2026-06-01 10:14:51.659568 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-28338 |
vulnerable | 2026-06-08 07:55:15.164871 |
PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages
MEDIUM (6.8)
PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.
Published: 2026-02-27T20:28:05.739Z
Updated: 2026-03-03T20:26:01.369Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-7722 |
vulnerable | 2026-06-08 05:14:14.683448 |
Details available
PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)
Published: 2019-02-11T14:00:00.000Z
Updated: 2024-08-04T20:54:28.325Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.