PT-2025-39485

Name of the Vulnerable Software and Affected Versions ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution versions prior to 4.8.4 Description The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is susceptible to unauthorized access. This is due to ...

SUSE CVE-2025-10923

GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

CVE-2025-10949

A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. T...

CVE-2025-10949

CVE-2025-10949 affects Changsha Developer Technology iView Editor

CVE-2025-10949 Changsha Developer Technology iView Editor Markdown cross site scripting

A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. T...

CVE-2025-10949 Changsha Developer Technology iView Editor Markdown cross site scripting

A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. T...

iView Editor 代码注入漏洞

iView Editor is an editor for iView open source. A code injection vulnerability exists in iView Editor 1.1.1 and earlier versions, which stems from improper handling of the component Markdown Handler, and could lead to cross-site scripting attacks...

PT-2025-39392

Name of the Vulnerable Software and Affected Versions Changsha Developer Technology iView Editor versions up to 1.1.1 Description A flaw exists in the Markdown Handler component of the software that allows for cross site scripting. The issue is remotely exploitable and details of the exploit are...

Horilla 安全漏洞

Horilla is a free and open source human resources software from Horilla Inc. A security vulnerability exists in Horilla versions prior to 1.4.0, which stems from the presence of stored cross-site scripting in the ticket comment editor that could cause a low-privileged user to execute arbitrary...

graphos-cli (>=1.0.0, <=1.0.1), panshi-client (>=0.0.7, <=0.0.8) potentially affected by CVE-2025-57320 via json-schema-editor-visual (>=1.1.1, <=2.0.0)

json-schema-editor-visual NPM version =1.1.1, =1.0.0, =0.0.7, =0.0.8 Source cves: CVE-2025-57320 Source advisory: SNYK:JS-JSONSCHEMAEDITORVISUAL-13110010...

Prototype Pollution

Overview json-schema-editor-visual is a jsonschema editor Affected versions of this package are vulnerable to Prototype Pollution via the setData or deleteData functions. An attacker can manipulate the prototype of objects by supplying a crafted payload, potentially leading to unauthorized...

GHSA-3C3P-XH4F-PFH7 json-schema-editor-visual vulnerable to prototype pollution

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload,...

json-schema-editor-visual vulnerable to prototype pollution

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload,...

CVE-2025-57320

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload,...

CVE-2025-57320

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload,...

CVE-2025-58232

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ickata Image Editor by Pixo image-editor-by-pixo allows DOM-Based XSS.This issue affects Image Editor by Pixo: from n/a through = 2.3.8...

CVE-2025-57909

Missing Authorization vulnerability in Rouergue Création Editor Custom Color Palette editor-custom-color-palette allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editor Custom Color Palette: from n/a through = 3.5.6...

DRUPAL-CONTRIB-2025-107

This module integrates Plausible Analytics on a site. The module did not properly filter output in certain cases. This vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment...

CVE-2025-57320

CVE-2025-57320 affects the package json-schema-editor-visual. Connected sources confirm a Prototype Pollution vulnerability in the setData and deleteData functions for versions up to and including 1.1.1, allowing a crafted payload to inject or delete properties on Object.prototype. Practical impa...

CVE-2025-57320

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload,...