Approved changes feed: RSS · Atom
cpe:2.3:a:299ko:299ko:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | 299Ko (383a21ea-8f2b-56f7-9991-01aa1a0ef152) |
|---|---|
| Product | 299Ko (2d0002f0-2ffd-5494-8e29-00846443054c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-71249 |
vulnerable | 2026-09-16 04:32:59.231882 |
299Ko - Unauthenticated Reflected XSS in Public Contact Form
MEDIUM (6.1)
299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine's variable output function (common/Template.php, _show_var) echoes values with no htmlspecialchars call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea.
Published: 2026-08-05T10:57:05.752Z
Updated: 2026-08-10T11:46:05.754Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.