TI-2026-22626 CVE-2026-28338 · GHSA-8rr6-2qw5-pc7r
PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages
Priority MEDIUM 63
PMD is an extensible multilanguage static code analyzer.
Pmd Project
Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Pmd Project records in CISA KEVNo Pmd Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
2 records in Pmd · all components
TI-2019-05439 CVE-2019-7722 · GHSA-57qj-79gh-69w8
PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part…
Priority LOW 38
PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets)…