13990 matches found
Cross-site Scripting (XSS)
Overview @astrojs/internal-helpers is an Internal helpers used by core Astro packages. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the isRemoteAllowed function. An attacker can execute arbitrary JavaScript in the victim's browser by submitting a crafted SVG...
CVE-2025-64759 Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload
Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an...
CVE-2025-64759 Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload
Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an...
EUVD-2025-198220
Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an...
CVE-2025-64759
CVE-2025-64759 affects Homarr before version 1.43.3, where a stored XSS flaw allows executing arbitrary JavaScript in a user’s browser via a malicious uploaded SVG. If an administrator views the page rendering or redirecting to the SVG, an attacker could add their account to the "credentials-admi...
mpdf-pocs
mPDF 8.2.6 PoCs Referenced by: - https:/...
CVE-2025-65019
Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter @astrojs/cloudflare with output: 'server', the image optimization endpoint /image contains a critical vulnerability in the isRemoteAllowed function that unconditionally allows data: protocol URLs. This enable...
CVE-2025-12457
The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...
Malicious Package
Overview react-svg-module is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in react-svg-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42e399f2b08fcb5a17dce3bb49a4f5dbeec6d8c56b34dab5586e8a84c5232d08 The package react-svg-helper was found to contain malicious code. Source: ghsa-malware f872307ebcfe0abab5b4fb796f5d770fd3678292ff059768bc62144d97fe03...
Malicious Package
Overview react-svg-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2025-198132
Malicious code in react-svg-helper npm...
Malicious code in react-svg-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9b392459196e5602d6e40cd38445d10e87e49d85b53b966aee554dd758fc1bd The package react-svg-module was found to contain malicious code. Source: ghsa-malware dd046bd4ddd4da53330303e0802201fda828bce7e1a21524aa7fc0da1fed95...
EUVD-2025-198131
Malicious code in react-svg-module npm...
MAL-2025-190572 Malicious code in react-svg-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9b392459196e5602d6e40cd38445d10e87e49d85b53b966aee554dd758fc1bd The package react-svg-module was found to contain malicious code. Source: ghsa-malware dd046bd4ddd4da53330303e0802201fda828bce7e1a21524aa7fc0da1fed95...
MAL-2025-190571 Malicious code in react-svg-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42e399f2b08fcb5a17dce3bb49a4f5dbeec6d8c56b34dab5586e8a84c5232d08 The package react-svg-helper was found to contain malicious code. Source: ghsa-malware f872307ebcfe0abab5b4fb796f5d770fd3678292ff059768bc62144d97fe03...
EasyImages 代码注入漏洞
EasyImages is a thin wrapper on PIL by Jakub Cieslik individual developer. It is used for exploring, visualizing and sharing images. A code injection vulnerability exists in EasyImages 2.8.6 and earlier versions, which stems from improper manipulation of the parameter File in the component SVG...
CVE-2025-64759: Improper Input Validation
Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an...
CVE-2025-13415: Improper Neutralization of Input During Web Page Generation
A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely...
EUVD-2025-197959
The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...