CVE-2018-8046

The getTip() method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip() method of Action Columns takes HTML-escaped data and un-escapes it. If the tooltip contains user-controlled data, an attacker could exploit this to create a cross-site scripting attack, even when developers took precautions and escaped data.

• CWE-79

• http://examples.sencha.com/extjs/6.6.0/release-notes.htmlRelease Notes, Vendor Advisory
• http://seclists.org/fulldisclosure/2018/Jul/8Mailing List, Third Party Advisory
• http://examples.sencha.com/extjs/6.6.0/release-notes.htmlRelease Notes, Vendor Advisory
• http://seclists.org/fulldisclosure/2018/Jul/8Mailing List, Third Party Advisory

Published

Jul 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-8040Pages that are rendered using the ESI plugin can have access…
• CVE-2018-8041Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.…
• CVE-2018-8042Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop …
• CVE-2018-8043The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-u…
• CVE-2018-8044K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affecte…7.8
• CVE-2018-8045In Joomla! 3.5.0 through 3.8.5, the lack of type casting of …
• CVE-2018-8047vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scr…
• CVE-2018-8048In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HT…
• CVE-2018-8049The Stealth endpoint in Unisys Stealth SVG 2.8.x, 3.0.x befo…
• CVE-2018-8050The af_get_page() function in lib/afflib_pages.cpp in AFFLIB…
• CVE-2018-8056Physical path Leakage exists in Western Bridge Cobub Razor 0…
• CVE-2018-8057A SQL Injection vulnerability exists in Western Bridge Cobub…