7765 matches found
CVE-2025-12354: Missing Authorization
The Live CSS Preview plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxfrontendsave' AJAX endpoint in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Subscriber-level access an...
CVE-2025-66554: Improper Neutralization of Input During Web Page Generation
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked ...
NextCloud cross-site scripting vulnerability
Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A cross-site scripting vulnerability exists in Nextcloud versions prior to 5.5.4, prior to 6.0.6, and prior to 7.2.5, which stems from a malicious user bei...
WordPress plugin Live CSS Preview has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
WordPress Live CSS Preview plugin <= 2.1.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Live CSS Preview versions = 2.1.4...
MAL-2025-192293 Malicious code in tailwindcss-animation-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1fda6d7eaefe792f8b06f7ef177feea15d90da13962dbe59f48d7987a234aca The package tailwindcss-animation-css was found to contain malicious code. Source: ghsa-malware...
Malicious code in tailwindcss-animation-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1fda6d7eaefe792f8b06f7ef177feea15d90da13962dbe59f48d7987a234aca The package tailwindcss-animation-css was found to contain malicious code. Source: ghsa-malware...
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Overview mdast-util-to-hast is a mdast utility to transform to hast Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the class attribute in rendered markdown code elements. An attacker can cause arbitrary CSS...
Malicious code in tailwindcss-forms (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65ee27d0caf9bfc7ff677eb3a3ab32742a19c31bc8418b532bbf925c6a5c385b The package tailwindcss-forms was found to contain malicious code...
CVE-2025-61167
SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opaccss/ajaxselector.php component via the id and datas parameters...
CVE-2025-65026
esm.sh is a nobuild content delivery networkCDN for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability CWE-94 in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter,...
EUVD-2025-199634
SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opaccss/ajaxselector.php component via the id and datas parameters...
CVE-2025-61167
SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opaccss/ajaxselector.php component via the id and datas parameters...
GO-2025-4139 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh...
SIGB PMB security vulnerabilities
SIGB PMB is an open source integrated library management system from SIGB. A security vulnerability exists in SIGB PMB version v8.0.1.14, which stems from improper handling of the parameters id and datas in the component /opaccss/ajaxselector.php, which could lead to a SQL injection attack...
PT-2025-48069
Name of the Vulnerable Software and Affected Versions SIGB PMB version 8.0.1.14 Description The software contains multiple SQL injection flaws in the /opac css/ajax selector.php component. These flaws are triggered through the id and datas parameters. The component is susceptible to manipulation...
CVE-2025-61167
SIGB PMB version v8.0.1.14 contains multiple SQL injection vulnerabilities within the /opac_css/ajax_selector.php component. These flaws are triggered via the id and datas parameters, where improper handling of crafted input may allow for unauthorized database access or modification. Remediation ...
Fedora 43 : webkitgtk (2025-6f3e9e3af6)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6f3e9e3af6 advisory. Prevent unsafe URI schemes from participating in media playback. Make jscvaluearraybuffergetdata function introspectable. Fix logging in to Google...
Malicious code in ids-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050d0a8d9340c416d7410787a1a7b2c5e6cec36eb17bacecca14a2cfbcbf76c5 The package ids-css was found to contain malicious code. Source: ghsa-malware 03812dbf5f0120164f355aae423e3fad2e899eb9164b4468f7fd91844d33b35e Any...