GCVE - cpe:2.3:a:jenkins:html_publisher:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:html_publisher:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Html Publisher (`2f110770-18b9-52cc-bc96-4fe71758f11e`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-42524`	vulnerable	2026-06-08 08:03:16.473903	Details available Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Published: 2026-04-29T13:31:32.905Z Updated: 2026-04-29T14:29:40.872Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3706	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-53651`	vulnerable	2026-06-08 07:31:14.860936	Details available Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log. Published: 2025-07-09T15:39:27.086Z Updated: 2025-11-04T21:11:54.112Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3547	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-28151`	vulnerable	2026-06-08 06:33:26.581425	Details available Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it. Published: 2024-03-06T17:01:55.535Z Updated: 2025-02-13T17:47:18.996Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3303 http://www.openwall.com/lists/oss-security/2024/03/06/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-28150`	vulnerable	2026-06-08 06:33:26.580970	Details available Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Published: 2024-03-06T17:01:53.898Z Updated: 2025-02-13T17:47:18.356Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3302 http://www.openwall.com/lists/oss-security/2024/03/06/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-28149`	vulnerable	2026-06-08 06:33:26.580537	Details available Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists. Published: 2024-03-06T17:01:53.259Z Updated: 2025-02-13T17:47:17.504Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3301 http://www.openwall.com/lists/oss-security/2024/03/06/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-10432`	vulnerable	2026-06-08 05:12:23.320700	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000175`	vulnerable	2026-06-08 05:10:25.581701	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.