CVE-2021-46888

An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.

• CWE-79

• https://github.com/simonmichael/hledger/issues/1525Exploit, Issue Tracking, Vendor Advisory
• https://github.com/simonmichael/hledger/pull/1663Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/simonmichael/hledger/releases/tag/1.23Release Notes
• https://www.youtube.com/watch?v=QnRO-VkfIicExploit, Third Party Advisory
• https://github.com/simonmichael/hledger/issues/1525Exploit, Issue Tracking, Vendor Advisory
• https://github.com/simonmichael/hledger/pull/1663Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/simonmichael/hledger/releases/tag/1.23Release Notes
• https://www.youtube.com/watch?v=QnRO-VkfIicExploit, Third Party Advisory

Published

May 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-46882The video framework has memory overwriting caused by additio…7.5
• CVE-2021-46883The video framework has memory overwriting caused by additio…7.5
• CVE-2021-46884The video framework has memory overwriting caused by additio…7.5
• CVE-2021-46885The video framework has memory overwriting caused by additio…7.5
• CVE-2021-46886The video framework has memory overwriting caused by additio…7.5
• CVE-2021-46887Lack of length check vulnerability in the HW_KEYMASTER modul…9.8
• CVE-2021-46889The 10Web Photo Gallery plugin through 1.5.69 for WordPress …6.1
• CVE-2021-46890Vulnerability of incomplete read and write permission verifi…9.8
• CVE-2021-46891Vulnerability of incomplete read and write permission verifi…9.8
• CVE-2021-46892Encryption bypass vulnerability in Maintenance mode. Success…7.5
• CVE-2021-46893Vulnerability of unstrict data verification and parameter ch…7.5
• CVE-2021-46894Use After Free (UAF) vulnerability in the uinput module.Succ…9.8