CVE-2023-25304

An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack file...

Linux Distros Unpatched Vulnerability : CVE-2022-25304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service DoS due to a missing limitation on the number of received...

SUSE CVE-2025-25304

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the vlSelectionTuples function can be used to call JavaScript functions, leading to cross-site...

DEBIAN-CVE-2025-25304

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the vlSelectionTuples function can be used to call JavaScript functions, leading to cross-site...

CVE-2025-25304

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the vlSelectionTuples function can be used to call JavaScript functions, leading to cross-site...

CVE-2025-25304

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the vlSelectionTuples function can be used to call JavaScript functions, leading to cross-site...

CVE-2025-25304 Vega allows Cross-site Scripting via the vlSelectionTuples function

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the vlSelectionTuples function can be used to call JavaScript functions, leading to cross-site...

CVE-2025-25304 Vega allows Cross-site Scripting via the vlSelectionTuples function

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the vlSelectionTuples function can be used to call JavaScript functions, leading to cross-site...

CVE-2025-25304

CVE-2025-25304 affects Vega (visualization grammar) and its vega-selections component. Before version 5.26.0 of Vega and 5.4.2 of vega-selections, the vlSelectionTuples function could call attacker-controlled JavaScript functions, including Function(), enabling cross-site scripting via multiple c...

CVE-2025-25304 Vega allows Cross-site Scripting via the vlSelectionTuples function

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the vlSelectionTuples function can be used to call JavaScript functions, leading to cross-site...

@candela/stats (>=0.20.0 <=0.21.0), @candela/vega (>=0.20.0 <=0.23.0) +129 more potentially affected by CVE-2025-25304 via vega (>=1.5.4 <=5.25.0)

vega NPM version =1.5.4, =0.20.0, =0.20.0, =0.3.0, =0.6.0, =1.0.5, =1.2.0, =0.0.2, =0.8.0, =3.1.3 - @jupyterlab/vega3-extension =0.14.3 and more Source cves: CVE-2025-25304 Source advisory: OSV:GHSA-MP7W-MHCV-673J...

CVE-2025-25304

creationtimestamp| type| source ---|---|--- 2025-02-14 16:10:32+00:00| published-proof-of-concept| https://github.com/vega/vega/security/advisories/GHSA-mp7w-mhcv-673j 2025-02-14 19:34:33+00:00| seen| https://infosec.exchange/users/cve/statuses/114003913828136574 2025-02-14 20:16:06+00:00| seen|...

CVE-2024-25304

creationtimestamp| type| source ---|---|--- 2024-02-09 14:21:21+00:00| seen| https://t.me/ctinow/182023 2024-02-09 15:26:50+00:00| seen| https://t.me/ctinow/182062 2024-02-12 17:17:29+00:00| seen| https://t.me/ctinow/183266...

CVE-2024-25304

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php."...

CVE-2024-25304

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php."...

CVE-2024-25304

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php."...

CVE-2024-25304

The CVE-2024-25304 affects Code-projects Simple School Management System 1.0, where an SQL Injection flaw exists in the School/index.php entry point via the 'apass' parameter. The root cause is lack of input validation for this parameter, enabling attackers to manipulate queries and potentially a...

CVE-2023-25304

creationtimestamp| type| source ---|---|--- 2023-03-06 20:12:53+00:00| seen| https://t.me/cibsecurity/59495...

CVE-2023-25304

An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack file...

CVE-2023-25304

Prism Launcher (up to v6.1) is affected by a directory traversal vulnerability triggered by importing a crafted .mrpack file. The underlying issue exposes potential reading of arbitrary files on the host when handling the import, with CVSS 3.1 vector indicating Local access, no privileges require...