397 matches found
MiracleLinux 8 : python-jinja2-2.10.1-4.el8 (AXSA:2024-8289:02)
The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2024-8289:02 advisory. jinja2: HTML attribute injection when passing user input as keys to xmlattr filter CVE-2024-22195 Tenable has extracted the preceding description block...
CVE-2023-49276
Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...
CVE-2025-14114
The 1180px Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-68457
Orejime is a consent manager that focuses on accessibility. On HTML elements handled by Orejime prior to version 2.3.2, one could run malicious code by embedding javascript: code within data attributes. When consenting to the related purpose, Orejime would turn data attributes into unprefixed one...
EUVD-2025-204591
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature...
CVE-2025-13141
CVE-2025-13141 affects the WordPress plugin HT Mega – Absolute Addons For Elementor. The vulnerability is a Stored Cross-Site Scripting in all versions up to 3.0.0, caused by insufficient validation of user-supplied HTML tag names in Gutenberg blocks and the lack of a tag-name whitelist, allowing...
WordPress HT Mega – Absolute Addons For Elementor plugin <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Tag Attribute Injection vulnerability discovered by Abu Hurayra HurayraIIT in WordPress Plugin HT Mega versions = 3.0.0...
EUVD-2009-2810
Malware in sbrugna...
EUVD-2017-17758
Malware in sbrugna...
EUVD-2024-33965
Malicious code in bioql PyPI...
EUVD-2024-0365
Malicious code in bioql PyPI...
EUVD-2023-3036
Malicious code in bioql PyPI...
EUVD-2025-15795
Malicious code in bioql PyPI...
EUVD-2023-57618
Malicious code in bioql PyPI...
spmrc 安全漏洞
spmrc is an open source spmrc management library from Static Package Manager. A security vulnerability exists in spmrc 1.2.0 and earlier versions, which stems from prototype contamination of the set and config functions, which allows an attacker to inject attributes via a specially crafted payloa...
SassDoc Extras 安全漏洞
SassDoc Extras is a SassDoc theme builder from SassDoc Open Source. A security vulnerability exists in SassDoc Extras 2.5.1 and earlier versions, which stems from a prototype contamination in the byGroupAndType function, which allows an attacker to inject attributes via a specially crafted payloa...
Linux Distros Unpatched Vulnerability : CVE-2017-1002201
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like ' must be escaped properly. In this case,...
CVE-2025-7845
The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...
GHSA-95JQ-XPH2-CX9H Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)
Prototype Pollution in internal assign helper in Linkify allows remote attackers to execute arbitrary JavaScript Stored or Reflected XSS via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2...
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)
Prototype Pollution in internal assign helper in Linkify allows remote attackers to execute arbitrary JavaScript Stored or Reflected XSS via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2...