5920 matches found
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
Summary A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. Technical Details The vulnerability occurs in...
GHSA-P6JQ-8VC4-79F6 Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
Summary A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. Technical Details The vulnerability occurs in...
CVE-2025-59414 Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival
Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specifi...
CVE-2025-59414 Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival
Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specifi...
CVE-2025-59414
Nuxt (Vue.js framework) exposes a client-side path traversal in the Island payload revival during prerendering. The vulnerability occurs in the revive-payload.client.ts flow when serialized __nuxt_island objects trigger Island fetches via /__nuxt_island/${key}.json, with key potentially containin...
Remote Code Execution (RCE)
unopim/unopim is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper input validation because the image upload on user creation performs only client-side file type checks, allowing an attacker to modify a captured upload change extension and content to .php and execute...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the comliferayportalsearchwebportletSearchPortletuserId parameter. An attacker can execute arbitrary web scripts or inject malicious HTML by supplying crafted input. Details Cross-site scripting or XSS is a...
Nuxt 路径遍历漏洞
Nuxt is a free open source framework from Nuxt Open Source. A path traversal vulnerability exists in Nuxt versions prior to 3.19.0 and prior to 4.1.0, which stems from a path traversal issue in the client-side payload recovery mechanism that could lead to an attacker manipulating client-side...
PT-2025-38250
Name of the Vulnerable Software and Affected Versions: Nuxt versions prior to 3.19.0 Nuxt versions prior to 4.1.0 Description: A client-side path traversal vulnerability exists in Nuxt's Island payload revival mechanism. This allows attackers to manipulate client-side requests to different...
Patika Global HumanSuite 安全漏洞
Patika Global HumanSuite is a human resource management platform from Patika Global, Turkey. A security vulnerability exists in Patika Global HumanSuite versions prior to 53.21.0, which stems from a user-controllable key leading to authorization bypass and improper authorization, which could be...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the remote app title field. An attacker can execute arbitrary web scripts or inject malicious HTML by submitting crafted input to this field. Details Cross-site scripting or XSS is a code vulnerability that...
1997ckf-ui-comp (>=0.0.9, <=0.0.17), 1data-business (>=0.0.1, <=0.0.3) +6163 more potentially affected by CVE-2025-57665 via element-plus (>=1.0.1-beta.0, <=2.14.4)
element-plus NPM version =1.0.1-beta.0, =0.0.9, =0.0.1, =1.0.0, =0.1.11, =0.1.0, =1.0.0, =0.3.1, =1.0.0-beta.0, =1.0.0, =0.0.1-alpha.10, =0.1.6-alpha.17, =0.1.6-alpha.18 - @17mkh/ui 0.0.2 - @1api/serve 0.1.0 and more Source cves: CVE-2025-57665 Source advisory: SNYK:JS-ELEMENTPLUS-12670415...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name field in Kaleo Forms Admin. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting a malicious payload that is stored and rendered without proper...
Proxmox Virtual Environment 安全漏洞
Proxmox Virtual Environment Proxmox VE is an open source server virtualization environment Linux distribution from Proxmox. A security vulnerability exists in Proxmox Virtual Environment version 8.4, which stems from a stored cross-site scripting vulnerability in the WebAuthn Relying Party field...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/admin process. An attacker can execute arbitrary scripts in the context of a user's browser by submitting...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/960grid process. An attacker can execute arbitrary scripts in the context of a user's browser by submitting...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/dialogs process. An attacker can execute arbitrary scripts in the context of a user's browser by submitting...
CVE-2025-52543
E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...
