Security vulnerabilities identified in Aoop CMS and serialize-javascript

Multiple security vulnerabilities have been identified in different software components.

Aoop CMS version 0.3.6 is affected by several SQL injection and Cross-Site Scripting (XSS) vulnerabilities. The SQL injection flaws allow attackers to inject arbitrary SQL statements, potentially leading to complete database compromise or data theft. The XSS vulnerabilities include non-persistent and persistent types, which could enable session hijacking or client-side context manipulation.

Additionally, a Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-115897, has been discovered in the Yahoo serialize-javascript npm package. Versions prior to 7.1.3 are affected due to a flaw in the regular expression used by the escapeFunctionBody() function. This flaw fails to properly neutralize HTML script closing tags within serialized JavaScript functions, allowing for the injection of arbitrary HTML or JavaScript. The issue has been addressed in version 7.1.3.