1556 matches found
WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting
The Easy Social Icons plugin = 3.0.8 for WordPress echoes out the raw value of $SERVER'PHPSELF' in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected cross-site scripting attack by injecting malicious code in the request path...
Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting
The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'planicons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...
jotty.page < 1.22.0 - Path Traversal
jotty·page 1.22.0 contains a path traversal caused by lack of validation on filename parameter in /api/app-icons/filename, letting unauthenticated attackers read arbitrary files outside intended directory. id: CVE-2026-42564 info: name: jotty.page 1.22.0 - Path Traversal author: Het-Kalariya...
Malicious Package
Overview @fmr-ap153177/apex-kit-icons is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious code in @fmr-ap153177/apex-kit-icons (npm)
Source: amazon-inspector ff7b14a37bdf740ac9f0e4c8978c2c577d39f04d7b897a5d698cbb220ecf3c9a package.json declares the sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz instead of a registry version range. On npm install, npm...
Malicious code in @fmr-ap153177/apex-kit-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff7b14a37bdf740ac9f0e4c8978c2c577d39f04d7b897a5d698cbb220ecf3c9a package.json declares the sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz...
MAL-2026-18279 Malicious code in @fmr-ap153177/apex-kit-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff7b14a37bdf740ac9f0e4c8978c2c577d39f04d7b897a5d698cbb220ecf3c9a package.json declares the sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz...
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
Summary installBazaarPlugin and the equivalent endpoints for widgets/icons/templates/themes accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone...
GHSA-RPX2-P6HP-X5GJ SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
Summary installBazaarPlugin and the equivalent endpoints for widgets/icons/templates/themes accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone...
UBUNTU-CVE-2026-91786
A flaw was found in GNOME Shell. When processing icons from a remote s...
DRUPAL-CONTRIB-2026-230
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...
PT-2026-120907
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...
UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...
UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221
This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. The module doesn't sufficiently validate icon settings provided by users before they are rendered...
Malicious code in sc-font-icons (npm)
Source: amazon-inspector 1b8c91edd839dd00f2e58ad9296742f8c3c5ff126523bbd8ed7561fef7c8516e The package's preinstall script runs automatically on npm install and collects installer-side identifiers — os.hostname, os.userInfo.username, process.cwd, the configured npm registry, and CI repository slug...
Malicious Package
Overview sc-font-icons is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Rocky Linux 8.6 [CIQ] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ciqsa-2026_1611)
The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261611 advisory. This advisory aggregates security fixes for the tigervnc SRPM in CIQ LTS 8.6. It addresses 21 CVEs: CVE-2017-7396, CVE-2025-49180, CVE-2025-26601,...
CVE-2026-42697
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5...
CVE-2026-42697 WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5...
