97 matches found
SUSE CVE-2026-79204
UI misrepresentation in Input in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-79204
UI misrepresentation in Input in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-66370
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction...
PT-2026-68622
Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An Open Redirect issue exists in the HTML5 scrubber where an unauthenticated remote attacker can retarget an existing form on a rendering page to capture submitted data, including...
GHSA-X4HG-HFWF-P9MW @asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation
Summary The HTMLInputElement.checkValidity method constructed a RegExp directly from the user-controlled pattern property without any sanitization or timeout protection. This allowed an attacker to inject a regex with catastrophic backtracking, freezing the event loop. Fix Fixed in commit...
CVE-2026-11293
Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...
CVE-2026-8513
Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-8513
Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-32732: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as...
EUVD-2013-6423
Malware in sbrugna...
Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r4h-vmj9-wg42. This link is maintained to preserve external references. Original Description Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
PT-2025-40840
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.5 Description Flowise has a cross-site scripting XSS issue. This occurs through a FORM element and an INPUT element when an administrator views the chat log. Recommendations Update Flowise to version 3.0.5 or late...
CVE-2025-29192: Improper Neutralization of Input During Web Page Generation
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
EUVD-2025-32480
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
Flowise security vulnerabilities
Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise versions prior to 3.0.5 that stems from the presence of cross-site scripting in the FORM element and the INPUT element, which could lead to cross-site scripting attacks...
CVE-2021-3291
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element within the modules edit page and inserting a command...
CVE-2024-1548
The Firefox browser and Thunderbird email client are vulnerable to a flaw where a website can use a dropdown select input element to obscure a fullscreen notification . This vulnerability could lead to user confusion and potential spoofing attacks . The affected versions include Firefox < 123 ...
PT-2024-1861
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 123 Firefox ESR versions prior to 115.8 Thunderbird versions prior to 115.8 Description The issue is related to errors in the representation of information by the user interface, which could lead to user confusion and...
GHSA-QWQH-HM9M-P5HR angular vulnerable to regular expression denial of service via the <input type="url"> element
All versions of the package angular are vulnerable to Regular Expression Denial of Service ReDoS via the element due to the usage of an insecure regular expression in the inputurl functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in...