CVE-2026-90835

A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.

Scoring

Severity

MEDIUM

CVSS base score

5.1

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

EPSS probability

0.20%

CWE

CWE-79, CWE-94

Published

2026-09-14

Last modified

2026-09-15

Affected products

• michaelliao itranswarp
• michaelliao itranswarp
• michaelliao itranswarp
• michaelliao itranswarp
• michaelliao itranswarp
• michaelliao itranswarp
• michaelliao itranswarp
• michaelliao itranswarp

Weakness type

• CWE-79
• CWE-94

Related vulnerabilities

• CVE-2026-78252 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
• CVE-2026-90943 — parallax filament-comments through 3.0.0 Stored XSS via Comment Body
• CVE-2026-90561 — Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
• CVE-2026-89256 — AVideo Bookmark Plugin Stored XSS via Chapter Names
• CVE-2026-89255 — AVideo LoginControl Stored XSS via PGP Public Key
• CVE-2026-89254 — AVideo CustomizeUser Stored XSS via field_name Parameter
• CVE-2026-89253 — AVideo Stored XSS via donationLink in watch page button
• CVE-2026-89249 — AVideo YPTWallet Stored XSS via CryptoWallet Configuration

Markdown version · Browse all CVEs