1126194 matches found
Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2025-66648)
Summary There are vulnerabilities in vega-functions-5.18.1.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-66648. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2025-66648 DESCRIPTION: vega-functions provides function implementations for the Vega...
CVE-2024-30476
PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentially exploit this vulnerability, it could lead to script execution in the client browser...
CVE-2024-30476
CVE-2024-30476 details a Stored Cross-Site Scripting vulnerability in Dell PowerStore Manager. A remote authenticated, low-privileged attacker could exploit this to execute scripts in the browser of an authenticated user. CVSS v3.1 base score 5.4 (Medium); attack vector: Network; privileges requi...
EUVD-2024-55623
PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentially exploit this vulnerability, it could lead to script execution in the client browser...
CVE-2024-30476
PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentially exploit this vulnerability, it could lead to script execution in the client browser...
NPM: Astro: XSS via Unescaped Attribute Names in Spread Props
NPM: Astro: XSS via Unescaped Attribute Names in Spread Props vulnerability discovered by ? in WordPress Npm astro versions 6.4.6...
Cross-site Scripting (XSS)
Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addAttribute function, which interpolates unescaped object keys as HTML attribute names when spreadi...
Astro: XSS via Unescaped Attribute Names in Spread Props
Summary The spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax ...props on an HTML element and the object...
GHSA-JRPJ-WCV7-9FH9 Astro: XSS via Unescaped Attribute Names in Spread Props
Summary The spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax ...props on an HTML element and the object...
NPM: Astro: Reflected XSS via unescaped slot name
NPM: Astro: Reflected XSS via unescaped slot name vulnerability discovered by ? in WordPress Npm astro versions 6.3.3...
Cross-site Scripting (XSS)
Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the data-astro-template attribute when a component uses a client: directive and the slot name is not...
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
Summary did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying element. When an application binds attacker-controlled input a query parameter, a CMS field, a user-supplied profile URL to or :href, the attacker can...
EUVD-2026-36428
Nuxt: Reflected XSS in via unsanitised javascript: or data: URL...
WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by VanTastic in WordPress Plugin JetEngine versions = 3.8.10...
CVE-2026-54198
Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.35 versions...
CVE-2026-54191
Unauthenticated Cross Site Scripting XSS in Pods = 3.3.8 versions...
CVE-2026-39437
Unauthenticated Cross Site Scripting XSS in Min Max Step Quantity Limits Manager for WooCommerce = 5.2.2 versions...
WordPress Secure Client Portal and Private File Sharing Plugin – User Private Files plugin <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by pham quang huy Zibanana in WordPress Plugin User Private Files versions = 2.1.6...