https://cti.al/tags/xss/Recent content in Xss on cti.alHugoen-usWed, 03 Jun 2026 10:00:00 +0200https://cti.al/posts/zammad-data-uri-xss-cve-2026-34718/Wed, 03 Jun 2026 10:00:00 +0200https://cti.al/posts/zammad-data-uri-xss-cve-2026-34718/Zammad's HTML sanitizer stripped javascript:, livescript: and vbscript: from links — but not data:. A data:text/html anchor survived sanitization and was stored verbatim in ticket articles.