2847 matches found
MAL-2025-41809 Malicious code in payment-banner (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 92762e9377e6c36f55c0751c31cbeed16a6095218e689bdafd2a4fd074382460 The OpenSSF Package Analysis project identified 'payment-banner' @ 10.0.1 npm as malicious. It is considered malicious because: - The package...
Liferay Portal/DXP Detection Consolidation
Consolidation of Liferay Portal/DXP detections. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; if description...
CVE-2025-52085
An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner a...
CVE-2025-52085
An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner a...
PT-2025-34475 · Yoosee · Yoosee
Name of the Vulnerable Software and Affected Versions: Yoosee version 6.32.4 Description: An SQL injection flaw exists in the Yoosee application that allows authenticated users to inject arbitrary SQL queries through a request to a backend API endpoint. Successful exploitation can lead to the...
CVE-2025-52085
An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner a...
CVE-2025-52085
Yoosee application (v6.32.4) contains an SQL injection in a backend API endpoint that authenticated users can exploit to extract sensitive DB information (server banner/version, current user/schema, privileges, and data from any table). CVE-2025-52085 is documented with a HIGH impact (C/H/I/A). A...
CVE-2025-54411
Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...
BIT-DISCOURSE-2025-54411 Discourse welcome banner user name XSS
Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...
CVE-2025-54411
Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...
CVE-2025-54411
CVE-2025-54411 affects Discourse prior to 3.5.0.beta8, where the welcome_banner.header.logged_in_members and the logged-in user name string can cause cross-site scripting (XSS). The underlying issue is in the welcome banner user name string, enabling XSS that may impact the user or allow an admin...
CVE-2025-54411 Discourse welcome banner user name XSS
Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...
CVE-2025-54411 Discourse welcome banner user name XSS
Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...
CVE-2025-54411 Discourse welcome banner user name XSS
Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...
PT-2025-33751 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.5.0.beta8 Description: Discourse, an open-source discussion platform, contains a cross-site scripting XSS issue in the welcome banner user name string for logged-in users. This can affect the user or an...
Discourse 跨站脚本漏洞
Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from a cross-site scripting attack in which an unescaped username string is...
Malicious code in jquery-app-banner (npm)
The package jquery-app-banner was found to contain malicious code...
MAL-2025-23895 Malicious code in jquery-app-banner (npm)
The package jquery-app-banner was found to contain malicious code...