--- include/classes/screens/CScreenHistory.php	2018-09-14 07:44:03.827000000 +0900
+++ include/classes/screens/CScreenHistory.php.new	2018-09-14 07:43:32.649000000 +0900
@@ -223,7 +223,7 @@ class CScreenHistory extends CScreenBase
 							->addClass($color);
 
 						if ($isManyItems) {
-							$row[] = (new CCol($host['name'].NAME_DELIMITER.$item['name_expanded']))
+							$row[] = (new CCol($host['name'].NAME_DELIMITER.specialchars($item['name_expanded'])))
 								->addClass($color);
 						}
 
@@ -250,7 +250,7 @@ class CScreenHistory extends CScreenBase
 							}
 						}
 
-						$row[] = (new CCol(new CPre(zbx_nl2br($data['value']))))->addClass($color);
+						$row[] = (new CCol(new CPre(zbx_nl2br(htmlspecialchars($data['value'])))))->addClass($color);
 
 						$historyTable->addRow($row);
 					}
--- latest.php	2018-09-14 07:44:00.380000000 +0900
+++ latest.php.new	2018-09-14 07:43:32.668000000 +0900
@@ -525,7 +525,7 @@ foreach ($items as $key => $item){
 			'',
 			$checkbox,
 			$hostColumn,
-			(new CCol([$item['name_expanded'], BR(), $itemKey]))->addClass($state_css),
+			(new CCol([htmlspecialchars($item['name_expanded']), BR(), $itemKey]))->addClass($state_css),
 			(new CCol(
 				($item['type'] == ITEM_TYPE_SNMPTRAP || $item['type'] == ITEM_TYPE_TRAPPER)
 					? UNKNOWN_VALUE
@@ -535,7 +535,7 @@ foreach ($items as $key => $item){
 			(new CCol($trendValue))->addClass($state_css),
 			(new CCol(item_type2str($item['type'])))->addClass($state_css),
 			(new CCol($lastClock))->addClass($state_css),
-			(new CCol($lastValue))->addClass($state_css),
+			(new CCol(htmlspecialchars($lastValue)))->addClass($state_css),
 			(new CCol($change))->addClass($state_css),
 			$actions,
 			$info
@@ -546,9 +546,9 @@ foreach ($items as $key => $item){
 			'',
 			$checkbox,
 			$hostColumn,
-			(new CCol($item['name_expanded']))->addClass($state_css),
+			(new CCol(htmlspecialchars($item['name_expanded'])))->addClass($state_css),
 			(new CCol($lastClock))->addClass($state_css),
-			(new CCol($lastValue))->addClass($state_css),
+			(new CCol(htmlspecialchars($lastValue)))->addClass($state_css),
 			(new CCol($change))->addClass($state_css),
 			$actions
 		]);
@@ -706,7 +706,7 @@ foreach ($items as $item) {
 			'',
 			$checkbox,
 			$hostColumn,
-			(new CCol([$item['name_expanded'], BR(), $itemKey]))->addClass($state_css),
+			(new CCol([htmlspecialchars($item['name_expanded']), BR(), $itemKey]))->addClass($state_css),
 			(new CCol(
 				($item['type'] == ITEM_TYPE_SNMPTRAP || $item['type'] == ITEM_TYPE_TRAPPER)
 					? UNKNOWN_VALUE
@@ -716,7 +716,7 @@ foreach ($items as $item) {
 			(new CCol($trendValue))->addClass($state_css),
 			(new CCol(item_type2str($item['type'])))->addClass($state_css),
 			(new CCol($lastClock))->addClass($state_css),
-			(new CCol($lastValue))->addClass($state_css),
+			(new CCol(htmlspecialchars($lastValue)))->addClass($state_css),
 			(new CCol($change))->addClass($state_css),
 			$actions,
 			$info
@@ -727,9 +727,9 @@ foreach ($items as $item) {
 			'',
 			$checkbox,
 			$hostColumn,
-			(new CCol($item['name_expanded']))->addClass($state_css),
+			(new CCol(htmlspecialchars($item['name_expanded'])))->addClass($state_css),
 			(new CCol($lastClock))->addClass($state_css),
-			(new CCol($lastValue))->addClass($state_css),
+			(new CCol(htmlspecialchars($lastValue)))->addClass($state_css),
 			(new CCol($change))->addClass($state_css),
 			$actions
 		]);
--- include/views/monitoring.history.php	2018-09-14 07:43:56.775000000 +0900
+++ include/views/monitoring.history.php.new	2018-09-14 07:43:32.687000000 +0900
@@ -45,9 +45,9 @@ if ($this->data['action'] != HISTORY_BAT
 	$header['left'] = [
 		$host['name'],
 		NAME_DELIMITER,
-		$item['name_expanded']
+		htmlspecialchars($item['name_expanded'])
 	];
-	$headerPlaintext[] = $host['name'].NAME_DELIMITER.$item['name_expanded'];
+	$headerPlaintext[] = $host['name'].NAME_DELIMITER.htmlspecialchars($item['name_expanded']);
 }
 elseif (count($hostNames) == 1) {
 	$header['left'] = [
@@ -127,7 +127,7 @@ if ($this->data['action'] == HISTORY_VAL
 
 		order_result($itemsData, 'name');
 		foreach ($itemsData as $item) {
-			$itemListbox->addItem($item['id'], $item['name']);
+			$itemListbox->addItem($item['id'], htmlspecialchars($item['name']));
 		}
 
 		$addItemButton = (new CButton('add_log', _('Add')))
--- popup.php	2018-09-14 07:43:50.751000000 +0900
+++ popup.php.new	2018-09-14 07:43:32.707000000 +0900
@@ -1245,8 +1245,8 @@ elseif ($srctbl === 'items' || $srctbl =
 		$host = reset($item['hosts']);
 		$item['hostname'] = $host['name'];
 
-		$description = new CLink($item['name_expanded'], 'javascript:void(0);');
-		$item['name'] = $item['hostname'].NAME_DELIMITER.$item['name_expanded'];
+		$description = new CLink(htmlspecialchars($item['name_expanded']), 'javascript:void(0);');
+		$item['name'] = $item['hostname'].NAME_DELIMITER.htmlspecialchars($item['name_expanded']);
 		$js_object = [];
 
 		if ($multiselect) {
