14 matches found
CVE-2018-25349
userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header. Attackers can send crafted requests to the backup.php endpoint with XSS payloads in the X-Forwarded-For header that execute when administrators...
CVE-2019-25349
creationtimestamp| type| source ---|---|--- 2026-02-20 03:40:12+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfb6qud6tq2u...
CVE-2021-25349
Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via hijacking the PendingIntent...
CVE-2025-25349
creationtimestamp| type| source ---|---|--- 2025-02-12 16:16:46+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhyl4dedsw2x 2025-02-12 18:19:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lhyry4d26227 2025-02-12 18:33:21+00:00| seen|...
CVE-2025-25349
The CVE concerns PHPGurukul Daily Expense Tracker System v1.1. The vulnerability is a SQL Injection in the /dets/add-expense.php endpoint due to the costitem parameter. Affects PHP-MySQL stack as described; impact is rated HIGH for confidentiality, integrity, and availability (CVSS 3.1: 9.8). The...
CVE-2025-0899: Use After Free
PDF-XChange Editor AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a maliciou...
5x5_uploader (>=1.0.0, <=1.2.2), @3t-transform/threeteeui (>=0.0.1, <=0.0.6) +136 more potentially affected by CVE-2022-25349 via materialize-css (>=1.0.0-rc.1, <=1.0.0)
materialize-css NPM version =1.0.0-rc.1, =1.0.0, =0.0.1, =1.0.1, =1.0.3, =1.0.0, =0.0.3, =1.0.2, =0.0.4, =0.0.6, =1.0.0, =1.0.0, =1.0.19, =1.0.8, =1.2.12 - @mariaav/tutorial 1.0.0 - @mariaav/tutorial2 1.0.0 and more Source cves: CVE-2022-25349 Source advisory: GHSA-7JVX-F994-RFW2...
CVE-2022-25349
All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...
CVE-2022-25349 Cross-site Scripting (XSS)
All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...
CVE-2022-25349
CVE-2022-25349 affects materialize-css: XSS caused by improper escaping of user input in the autocomplete component, allowing input such as to be parsed as HTML/JavaScript and executed in the DOM. Connected sources (Veracode, OSV, SNYK) confirm all versions are vulnerable with the root cause in ...
CVE-2022-25349
Removed by vendor...
CVE-2021-25349
Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via hijacking the PendingIntent...
CVE-2021-25349
The CVE-2021-25349 entry concerns the Slow Motion Editor. Affected: Slow Motion Editor versions prior to 3.5.18.5. Root cause: use of an unsafe PendingIntent that allows a local attacker to hijack PendingIntent and perform unauthorized actions without user permission. Impact details in sources in...