Malicious code in ideal-paypal-payment-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a0c63436afa43460fe75374c026568d5b5f17a29326ac24517be8a2b1dcd113 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in js-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc4563d5bd3e84486a04f455708e6480fadf633778880ca2710f2778aafad55c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-25477: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...

CVE-2025-25477

A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...

PT-2025-9042 · Syspass · Syspass

Name of the Vulnerable Software and Affected Versions: SysPass versions 3.2.x Description: A host header injection vulnerability in SysPass allows an attacker to load malicious JS files from an arbitrary domain, which would be executed in the victim's browser. Recommendations: For SysPass version...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in jsonata-js JSONata

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of jsonata-js JSONata. Vulnerability Details CVEID:CVE-2024-27307 DESCRIPTION: jsonata-js JSONata could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in the JSONata...

Visual Studio Code JS Debug Privilege Escalation

The vulnerability of Visual Studio Code’s JS Debug editor for source code editing is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to enhance their privileges...

@agent-embed/js (>=0.0.1, <=2.1.0), @altbot/js (>=1.0.0, <=1.0.1) +266 more potentially affected by CVE-2025-27109 via solid-js (>=1.0.0-rc.2, <=1.9.3)

solid-js NPM version =1.0.0-rc.2, =0.0.1, =1.0.0, =1.1.7, =0.0.1, =0.0.1, =0.0.7, =0.0.1, =0.0.1, =0.1.26, =0.0.1, =0.0.1-3.1-dev, =0.0.17 - @codyg/datatables 0.0.1 - @converseform.com/js 0.2.31 and more Source cves: CVE-2025-27109 Source advisory: OSV:GHSA-3QXH-P7JC-5XH6...

@agent-embed/js (>=0.0.1, <=2.1.0), @altbot/js (>=1.0.0, <=1.0.1) +266 more potentially affected by CVE-2025-27109 via solid-js (>=1.0.0-rc.2, <=1.9.3)

solid-js NPM version =1.0.0-rc.2, =0.0.1, =1.0.0, =1.1.7, =0.0.1, =0.0.1, =0.0.7, =0.0.1, =0.0.1, =0.1.26, =0.0.1, =0.0.1-3.1-dev, =0.0.17 - @codyg/datatables 0.0.1 - @converseform.com/js 0.2.31 and more Source cves: CVE-2025-27109 Source advisory: GHSA-3QXH-P7JC-5XH6...

PT-2025-7751 · Playerjs · Playerjs

Name of the Vulnerable Software and Affected Versions: PlayerJS versions n/a through 2.23 Description: The issue affects PlayerJS, allowing DOM-Based XSS due to improper neutralization of input during web page generation. This enables cross-site scripting. Recommendations: For versions n/a throug...

CVE-2025-27109

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

CVE-2025-1467

The CVE-2025-1467 entry concerns tarteaucitronjs versions before 1.17.0, which are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight() functions. Multiple sources (NVD, Red Hat, Veracode, OSV, CIRCL, GHSA) consistently describe the flaw as an XSS issue rooted in in...

CVE-2025-1328

The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-27109

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

CVE-2025-27109 Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

CVE-2025-27109

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

CVE-2025-27109

SolidJS CVE-2025-27109 describes a Cross-Site Scripting (XSS) vulnerability where user input rendered inside illegal inlined JSX fragments could be unescaped. Affected: SolidJS library with problematic JSX fragment handling. Root cause: lack of escaping in JSX fragments that allows user input to ...

CVE-2025-27109 Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

CVE-2025-27109 Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...

PT-2025-7524

Name of the Vulnerable Software and Affected Versions iteachyou Dreamer CMS version 4.1.3 Description A problematic issue has been found in iteachyou Dreamer CMS, affecting some unknown processing of the file /resource/js/ueditor-1.4.3.3. The manipulation leads to path traversal. The attack may b...