665 matches found
CVE-2025-7739
An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions...
UBUNTU-CVE-2025-7739
An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions...
CVE-2025-7739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions...
CVE-2025-7739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions...
CVE-2025-7739
GitLab CE/EE CVE-2025-7739 affects all versions 18.2 prior to 18.2.2. Under certain conditions, authenticated users could perform stored cross-site scripting by injecting malicious HTML into scoped label descriptions. Root cause described as a stored XSS vulnerability; exploitation status not det...
CVE-2025-7739
Removed by vendor...
CVE-2025-20332
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this...
TelegAI 跨站脚本漏洞
TelegAI is an AI chatbot website from TelegAI, Inc. A cross-site scripting vulnerability exists in TelegAI version 2025-05-26, which stems from an SVG cross-site scripting payload that can be embedded in AI role descriptions, leading to a stored cross-site scripting attack...
WordPress plugin Terms descriptions 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...
Malicious code in ai-audio-descriptions (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebf35a4094455afefae874d2367ecf96babc419a5ff8c0474f68beea08f3177b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-5888 Malicious code in ai-audio-descriptions (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebf35a4094455afefae874d2367ecf96babc419a5ff8c0474f68beea08f3177b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the search bar process when page descriptions are inserted into raw HTML without proper sanitization. An attacker can execute arbitrary JavaScript in the context of another user by injecting malicious conten...
CVE-2025-53370
CVE-2025-53370 concerns the Citizen MediaWiki skin. Versions 1.9.4 up to 3.3.9 expose a stored XSS via the ShortDescription extension: the shortdesc is inserted into the DOM as raw HTML, enabling arbitrary HTML/JS execution by page edits. A patch exists in version 3.4.0. Public references and adv...
CVE-2025-53370 Citizen stored XSS vulnerability through short descriptions
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page...
CVE-2025-53370 Citizen stored XSS vulnerability through short descriptions
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page...
CVE-2025-53327
Cross-Site Request Forgery CSRF vulnerability in ruimashita Aioseo Multibyte Descriptions aioseo-multibyte-descriptions allows Cross Site Request Forgery.This issue affects Aioseo Multibyte Descriptions: from n/a through = 0.0.6...
WordPress Aioseo Multibyte Descriptions plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin Aioseo Multibyte Descriptions versions = 0.0.6...
CVE-2025-53327
Cross-Site Request Forgery CSRF vulnerability in ruimashita Aioseo Multibyte Descriptions aioseo-multibyte-descriptions allows Cross Site Request Forgery.This issue affects Aioseo Multibyte Descriptions: from n/a through = 0.0.6...
CVE-2025-53327 WordPress Aioseo Multibyte Descriptions plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in ruimashita Aioseo Multibyte Descriptions aioseo-multibyte-descriptions allows Cross Site Request Forgery.This issue affects Aioseo Multibyte Descriptions: from n/a through = 0.0.6...