69187 matches found
WS-2020-0081
get-setter through 0.0.0 is vulnerable to prototype pollution. The function set does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects...
WS-2020-0018
All versions of npm-git-publish are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an execSync call, which may allow attackers to execute arbitrary code in the system. The publish function is vulnerable through the gitRemoteUrl variable...
CVE-2026-5365
The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2. This is due to missing nonce verification on the requestcancellation function. This makes it possible for unauthenticated attackers to cancel a logged-in customer's bookings v...
CVE-2026-5193
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.5.13. This is due to insufficient role validation in the 'registeruser' function, which only blocks the 'administrator' rol...
WS-2019-0263
Smart-extend, in all versions, is vulnerable to Prototype Pollution. The deep function allowing attackers to modify the prototype of Object , hence causing the addition or modification of an existing property that will exist on all objects...
WS-2019-0260
In Notevil, versions prior to 1.3.2, are vulnerable to Sandbox Escape leading to Remote Code Execution. Not checking the return values of function calls cause the package to fail in preventing access to the Function constructor. This allows attackers to access the Function prototype's constructor...
CVE-2017-16004
node-serialize ll versions can be abused to execute arbitrary code via an immediately invoked function expression...
CVE-2014-8881
All versions of the "bleach" package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function...
CVE-2026-46446
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to cpassword = '%@' in changePasswordForLogin...
CVE-2026-46446
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to cpassword = '%@' in changePasswordForLogin...
WS-2017-0241
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0242
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0243
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0244
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0223
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0173
Affected versions of the package are vulnerable due to the mishandling if the logout function in IE8...
WS-2017-0246
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0240
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...