CVE-2026-64944None▾ SunlitImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without pa…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
apache_answer <= 2.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67249NoneApache Answer: Email Code Purpose Confusion May Allow Account Takeover
CVE-2026-64943NoneApache Answer: API keys logged in plaintext during authentication
CVE-2026-64945NoneApache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
CVE-2026-79624NoneApache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
CVE-2026-71563NoneApache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
CVE-2026-68482NoneApache Answer: Improper Authorization in Question Invite User Lookup