{"id":82448,"date":"2026-07-23T16:46:25","date_gmt":"2026-07-23T13:16:25","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2026-15037-xml-injection-vulnerability-in-qdom-comment-cdata-and-processing-instruction-serialization\/"},"modified":"2026-07-23T16:46:25","modified_gmt":"2026-07-23T13:16:25","slug":"cve-2026-15037-xml-injection-vulnerability-in-qdom-comment-cdata-and-processing-instruction-serialization","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2026-15037-xml-injection-vulnerability-in-qdom-comment-cdata-and-processing-instruction-serialization\/","title":{"rendered":"CVE-2026-15037 &#8211; XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization"},"content":{"rendered":"<p>CVE ID :CVE-2026-15037<\/p>\n<p>  Published : July 23, 2026, 1:16 p.m. | 31\u00a0minutes ago<\/p>\n<p>  Description :Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.<\/p>\n<p>  Severity: 2.9 | LOW<\/p>\n<p>  Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID :CVE-2026-15037 Published : July 23, 2026, 1:16 p.m. | 31\u00a0minutes ago Description :Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-82448","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/82448","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=82448"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/82448\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=82448"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=82448"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=82448"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}