PT-2025-48262

Name of the Vulnerable Software and Affected Versions pretix affected versions not specified Description The software allows the use of placeholders in email templates that are populated with customer data, such as the attendee's name. If a customer's name contains HTML or Markdown formatting, th...

CVE-2025-13742: Improper Encoding or Escaping of Output

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when name is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML i...

Cross-Site Scripting (XSS)

nicegui is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the framework not sanitizing HTML or JavaScript when rendering unescaped user input through ui.html, which allows an attacker to execute arbitrary JavaScript in a user’s browser...

CVE-2025-53354

NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting XSS when developers render unescaped user input into the DOM using ui.html. NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.inpu...

EUVD-2020-0528

Malware in sbrugna...

EUVD-2020-7229

Malware in sbrugna...

EUVD-2023-1481

Malicious code in bioql PyPI...

EUVD-2022-3617

Malicious code in bioql PyPI...

EUVD-2022-52128

Malicious code in bioql PyPI...

EUVD-2022-4330

Malicious code in bioql PyPI...

EUVD-2022-1096

Malicious code in bioql PyPI...

EUVD-2023-2726

Malicious code in bioql PyPI...

EUVD-2022-6383

Malicious code in bioql PyPI...

EUVD-2022-4215

Malicious code in bioql PyPI...

EUVD-2025-5079

Malicious code in bioql PyPI...

EUVD-2022-6468

Malicious code in bioql PyPI...

EUVD-2023-52362

Malicious code in bioql PyPI...

GHSA-8C95-HPQ2-W46F NiceGUI has a Reflected XSS

Summary A Cross-Site Scripting XSS risk exists in NiceGUI when developers render unescaped user input into the DOM using ui.html. Before version 3.0, NiceGUI does not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.input with ui.html without...

NiceGUI has a Reflected XSS

Summary A Cross-Site Scripting XSS risk exists in NiceGUI when developers render unescaped user input into the DOM using ui.html. Before version 3.0, NiceGUI does not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.input with ui.html without...

Cross-site Scripting (XSS)

Vue I18n is vulnerable to Cross-site Scripting XSS. The vulnerability is due to incomplete escaping of interpolated parameters caused by the failure of the escapeParameterHtml: true option to prevent tag-based payload execution when rendered using v-html, even with minor HTML in translation strin...