CVE-2013-4660

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation...

CVE-2018-21002

The js-support-ticket plugin before 2.0.6 for WordPress has CSRF...

CVE-2015-10103

A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation of the argument setForgetTime with the input 0 leads to infinite loop. It is possible to launch the attack on the loca...

CVE-2014-125069

A vulnerability was found in saxman maps-js-icoads. It has been classified as problematic. Affected is an unknown function. The manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely. The name of the patch is...

CVE-2025-22792

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2...

CVE-2025-22792

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2...

CVE-2025-26621 OpenCTI vulnerable to Denial of Service through web hook

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype...

CVE-2025-22792

CVE-2025-22792 applies to WordPress plugin Js O3 Lite (Jinwen Js O3 Lite), with Reflected XSS caused by improper input neutralization during web page generation. Affected: Js O3 Lite ≤ 1.5.8.2. CVSS 3.1 base score 7.1 (HIGH). Remediation: update to a version that includes a fix (no specific fixed...

CVE-2025-22792 WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2...

CVE-2025-22792 WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2...

Malware in js-lib-const

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2025-22004 · Unknown · Jinwen Js O3 Lite

Name of the Vulnerable Software and Affected Versions: jinwen Js O3 Lite versions 1.5.8.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

Multer security vulnerabilities

Multer is an expressjs open source middleware for Node.js. A security vulnerability exists in Multer versions prior to 2.0.0, which stems from improper handling of streams and could lead to resource exhaustion and memory leaks...

CVE-2025-22792: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2...

Malware in lrc20-js-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

SUSE CVE-2025-23165

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uvfss.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory...

CVE-2022-25858 affecting package uglify-js for versions less than 3.19.3-11

CVE-2022-25858 affecting package uglify-js for versions less than 3.19.3-11. An upgraded version of the package is available that resolves this issue...

Malicious code in mocha-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 974699e98300e89373497533de0a530f3fd50cb861552f50aad60f7c3ab1ff4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in mocha-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-3838 Malicious code in mocha-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 974699e98300e89373497533de0a530f3fd50cb861552f50aad60f7c3ab1ff4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...