Approved changes feed: RSS · Atom
cpe:2.3:a:pmd:pmd:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Pmd (bbb36775-3dc3-51f0-a301-11226ec0aa5a) |
|---|---|
| Product | Pmd (89d39c78-151b-5131-a3bd-2721b114f8f2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-28338 |
vulnerable | 2026-06-08 07:55:15.163661 |
PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages
MEDIUM (6.8)
PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.
Published: 2026-02-27T20:28:05.739Z
Updated: 2026-03-03T20:26:01.369Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-23215 |
vulnerable | 2026-06-08 07:10:55.358358 |
PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered potentially compromised. As a mitigation, both compromised keys have been revoked so that no future use of the keys are possible. Note, that the published artifacts in Maven Central under the group id net.sourceforge.pmd are not compromised and the signatures are valid.
Published: 2025-01-31T15:25:53.026Z
Updated: 2025-04-04T21:08:48.961Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.