Veille CVE

Recherche « AmauriC tarteaucitron.js »

2 CVE

Critique 0 Élevée 0 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « AmauriC tarteaucitron.js » ✕
  1. CVE-2026-111714 3.1 Faible

    AmauriC tarteaucitron.js

    tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.

  2. CVE-2026-111713 5.4 Moyenne

    AmauriC tarteaucitron.js

    tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.