CVE-2023-43875-Subrion-CMS-Reflected-XSS---Installation

Subrion CMS Reflected XSS v4.2.1 Author: Sergio Description: Multiple Cross-Site Scripting XSS vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and...

VUL4J-60

antisamy A library for performing fast, configurable cleansing of HTML coming from untrusted sources. Another way of saying that could be: It's an API that helps you make sure that clients don't supply malicious cargo code in the HTML they supply for their profile, comments, etc., that get...

CLEANSTART-2024-ZN51554 JIT optimizations involving the Javascript arguments object could confuse later optimizations

CVE-2020-15656 affects multiple packages. JIT optimizations involving the Javascript arguments object could confuse later optimizations. See references for individual vulnerability details...

CLEANSTART-2024-GM24245 Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contentedita...

CVE-2020-15676 affects multiple packages. Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. See references for individual vulnerability...

CLEANSTART-2024-EJ00277 Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash

CVE-2021-23960 affects multiple packages. Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. See references for individual vulnerability details...

CLEANSTART-2024-QD38555 Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash

CVE-2021-23954 affects multiple packages. Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. See references for individual vulnerability details...

CLEANSTART-2024-FS95254 By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other a...

Security vulnerability affects the firefox package. By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other attacks on a user...

Flowise-RCE-CVE-2025-59528

CVE-2025-59528 - Flowise AI Authenticated Remote Code Execution RCE Overview CVE ID: CVE-2025-59528 Affected Software: Flowise AI Vulnerable Versions: = 3.0.4 Fixed Version: 3.0.5 and later Severity: Critical Author: arensballiu Date: 2025 Description Flowise AI versions up to and including 3.0.4...

CLEANSTART-2024-MK49236 If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape

Security vulnerability affects the firefox-esr package. If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape...

CLEANSTART-2024-MW00121 Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed underneath it

Security vulnerability affects the firefox package. Under certain circumstances, a JavaScript alert or prompt could have been shown while another website was displayed underneath it...

CLEANSTART-2024-NU92071 When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses

CVE-2022-22760 affects multiple packages. When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. See references for individual vulnerability details...

CLEANSTART-2024-MX03398 By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the same-origin policy) even after the tab wa...

Security vulnerability affects the firefox package. By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript within the bounds of the same-origin policy even after the tab was closed...

CLEANSTART-2024-YT40823 If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to ...

CVE-2022-26384 affects multiple packages. If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. See references for individual...

CLEANSTART-2024-GO13066 While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts

Security vulnerability affects the firefox package. While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts...

CLEANSTART-2024-HU82348 If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged co...

CVE-2022-1802 affects multiple packages. If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. See references for individual vulnerability details...

CVE-2026-82090-18-Years-All-Versions-CVSS-9.2-CRITICAL-The-Pocket-Forever-Day

XSS 0-Click / 0-Day Vulnerability Report Cross-Site Scripting 0-Click Leading to JavaScript Bridge Abuse in Pocket Android & iOS — CVSS 9.2 CRITICAL CVE-2026-82090 — Published by MITRE Corporation 2026-08-28 Author: Ing. Zampier Zago FUNFACTOR1 Division: Section 1 — Department of Cyber Security, ...

CLEANSTART-2024-IF55899 Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected

Security vulnerability affects the go package. Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected...

CVE-2025-57389

CVE-2025-57389 - Reflected XSS in OpenWRT 18.06.2 Description A reflected cross-site scripting XSS vulnerability was identified in EOL Luci OpenWRT v18.06.2 on /cgi-bin/luci/admin/system/packages endpoint. Proof of Concept 1. While proxying the traffic to Burp, navigate to...

CVE-2026-112365

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'coverletter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping...

CVE-2025-56605

CVE-2025-56605 XSS Cross-Site Scripting Vulnerability CVE-2025-56605 — Reflected XSS in Event Management System 1.0 Description: A reflected Cross-Site Scripting XSS vulnerability exists in register.php of PuneethReddyHC/event-management 1.0. The mobile POST parameter is improperly validated and...