EUVD-2025-10017

Malicious code in bioql PyPI...

EUVD-2022-3374

Malicious code in bioql PyPI...

Cross-site Scripting (XSS)

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the homepage endpoint via the last name field. An attacker can execute arbitrary JavaScript code in the context of a user's browser by...

Microweber XSS Vulnerability in the homepage Endpoint

Microweber CMS 2.0 is vulnerable to Cross Site Scripting XSS in the /projects/profile, homepage endpoint via the last name field...

CVE-2025-51504

Microweber CMS 2.0 is vulnerable to Cross Site Scripting XSSin the /projects/profile, homepage endpoint via the last name field...

CVE-2025-51504

Microweber CMS 2.0 is vulnerable to Cross Site Scripting XSSin the /projects/profile, homepage endpoint via the last name field...

CVE-2025-51504

Microweber CMS 2.0 is vulnerable to Cross Site Scripting XSSin the /projects/profile, homepage endpoint via the last name field...

PT-2025-31652 · Unknown · Microweber Cms

Name of the Vulnerable Software and Affected Versions: Microweber CMS version 2.0 Description: Microweber CMS 2.0 is vulnerable to Cross Site Scripting XSS in the /projects/profile and homepage endpoint via the last name field. Recommendations: For Microweber CMS version 2.0, sanitize or encode t...

Microweber CMS 安全漏洞

Microweber CMS is a drag-and-drop website builder from Microweber Open Source. A security vulnerability exists in Microweber CMS version 2.0, which stems from cross-site scripting in the last name field in the /projects/profile and homepage endpoints...

CVE-2025-49453

CVE-2025-49453 is a CSRF-to-Stored XSS vulnerability in the BP Profile as Homepage WordPress plugin. The connected Red Hat and vulnerability record confirm the issue affects BP Profile as Homepage up to version 1.1, with CVSSv3.1 base score 7.1 (HIGH) and a network attack vector requiring user in...

CVE-2025-49453 WordPress BP Profile as Homepage plugin <= 1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jatinder Pal Singh BP Profile as Homepage bp-profile-as-homepage allows Stored XSS.This issue affects BP Profile as Homepage: from n/a through = 1.1...

CVE-2024-1771

The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the totalordersections function in all versions up to, and including, 2.1.59. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeat...

CVE-2024-42364

Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepage is setup without certificate and authentication by default, leaving it to vulnerable to DNS rebinding. In this attack, an attacker will...

CVE-2023-30520

Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads...

CVE-2022-43480

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Magneticlab Sàrl Homepage Pop-up plugin = 1.2.5 versions...

CVE-2021-3184

MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/globalmenu.ctp user homepage favourite button...

CVE-2020-18167

Cross Site Scripting XSS in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu"...

CVE-2010-3009

Unspecified vulnerability in HP System Management Homepage SMH for Linux 6.0 and 6.1 allows remote authenticated users to obtain sensitive information and gain root privileges via unknown vectors...

CVE-2010-3283

Open redirect vulnerability in HP System Management Homepage SMH before 6.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2010-3012

Cross-site scripting XSS vulnerability in HP System Management Homepage SMH before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this issue was originally assigned CVE-2010-3010 due to a CNA error...