Filtered by vendor Pmd Project Subscriptions
Filtered by product Pmd Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-28338 2 Pmd, Pmd Project 2 Pmd, Pmd 2026-03-03 6.8 Medium
PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScript that runs when opened in a browser. Practical impact is limited because `vbhtml` and `yahtml` are legacy formats rarely used in practice. The default `html` format is properly escaped and not affected. Version 7.22.0 contains a fix for the issue.
CVE-2019-7722 1 Pmd Project 1 Pmd 2024-11-21 N/A
PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)