1179 matches found
Cross-Site Scripting (XSS)
Mermaid is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to user-supplied input for architecture diagram icons being passed to the d3 html method, which allows an attacker to inject and execute malicious scripts...
CVE-2025-0076
In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-0076
In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-0076
In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-0076
In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-0076
In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-0076
Google Android CVE-2025-0076 describes an information-disclosure flaw where a missing permission check could allow viewing icons belonging to another user. Exploitation requires local access with no user interaction, aligning with the CVSS local access and low impact (C:L, I:N, A:N). Connected so...
PT-2025-36030
Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A missing permission check may allow a user to view icons belonging to another user, potentially leading to local information disclosure. User interaction is not required for exploitation...
Malicious code in pp-react-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb754d012bc21065e6e4e5d42668a8b226bb1c18d2f8ef04c9ce6a2a8b9f1c47 The OpenSSF Package Analysis project identified 'pp-react-icons' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
MAL-2025-42130 Malicious code in pp-react-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb754d012bc21065e6e4e5d42668a8b226bb1c18d2f8ef04c9ce6a2a8b9f1c47 The OpenSSF Package Analysis project identified 'pp-react-icons' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
Malicious code in tombac-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3cbbd454182b1e77985f474c87e277b8b0e4efa49cc80edb90c60f7d3a12914 The OpenSSF Package Analysis project identified 'tombac-icons' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
MAL-2025-41272 Malicious code in tombac-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3cbbd454182b1e77985f474c87e277b8b0e4efa49cc80edb90c60f7d3a12914 The OpenSSF Package Analysis project identified 'tombac-icons' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
CVE-2025-49395
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Icons themify-icons allows Stored XSS.This issue affects Themify Icons: from n/a through = 2.0.3...
Malicious code in @navancorp/icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00d23863df2bb18ff4d7478d9d974206ad5e1959e64da8883e6623a5747b4ad3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-41426 Malicious code in @navancorp/icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00d23863df2bb18ff4d7478d9d974206ad5e1959e64da8883e6623a5747b4ad3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress Themify Icons Plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Themify Icons versions = 2.0.3...
CVE-2025-49395
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Icons themify-icons allows Stored XSS.This issue affects Themify Icons: from n/a through = 2.0.3...
CVE-2025-49395 WordPress Themify Icons Plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Icons allows Stored XSS. This issue affects Themify Icons: from n/a through 2.0.3...
CVE-2025-49395 WordPress Themify Icons Plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Icons themify-icons allows Stored XSS.This issue affects Themify Icons: from n/a through = 2.0.3...
CVE-2025-49395
CVE-2025-49395 affects Themify Icons plugin for WordPress (versions up to 2.0.3). The issue is a Stored Cross-Site Scripting (XSS) caused by improper neutralization of user-supplied input during web page generation. Exploitation could allow an attacker to inject and execute script in an admin/use...