45 matches found
Improper Encoding or Escaping of Output
Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via improper handling of...
CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the rendering of breadcrumbs in the page list view. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious input into the breadcrumb display. Details Cross-site...
CVE-2026-56698: Improper Neutralization of Input During Web Page Generation
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin when...
CVE-2026-39344: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting XSS vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly...
CVE-2019-25265: Improper Neutralization of Input During Web Page Generation
Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section. Attackers can inject malicious JavaScript through the description field that will execute when the groups page is viewed, allowing potential cookie...
CVE-2025-65098: Improper Neutralization of Input During Web Page Generation
Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI key...
EUVD-2025-22327
Malicious code in bioql PyPI...
EUVD-2024-20705
Malicious code in bioql PyPI...
EUVD-2025-22332
Malicious code in bioql PyPI...
EUVD-2023-45031
Malicious code in bioql PyPI...
EUVD-2025-14288
Malicious code in bioql PyPI...
CVE-2025-51860
Stored Cross-Site Scripting XSS in TelegAI telegai.com 2025-05-26 in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by crafting an AI Character with SVG XSS payloads in either description, greeting, example dialog, or system...
CVE-2024-23186
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer...
CVE-2025-46749 Improper Neutralization of Input
An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution...
CVE-2025-46749 Improper Neutralization of Input
An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution...
PT-2025-13093
Name of the Vulnerable Software and Affected Versions jAlbum Bridge versions 2.0.17 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This enables potential attackers to...
PT-2025-12900
Name of the Vulnerable Software and Affected Versions NotFound Frontend Post Submission versions n/a through 1.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS in NotFound Frontend...
CVE-2024-33007: Improper Neutralization of Input During Web Page Generation
PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript or any harmful client-side script, the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential securi...
CVE-2024-23186
Summary: CVE-2024-23186 affects Open-Xchange Open-Xchange App Suite (see connected sources). An email contains malicious display-name information that can trigger client-side script execution on specific mobile devices, enabling attackers to perform malicious API requests or extract data from use...