Cross-site Scripting (XSS)

Overview org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the calculateMathMLDimensions function, which was introduced in 5c69e5f. An attacker...

CVE-2025-53631

flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads to arbitrary JavaScript execution XSS on all pages the post is reflected on including /, /post/ID, /admin/posts, and /user/ID of the user...

N-able N-Central Command Injection Vulnerability

N-able N-Central contains a command injection vulnerability via improper sanitization of user input...

Security update for dpkg

This update for dpkg fixes the following issues: CVE-2025-6297: Fixed an improper sanitization of directory permissions that could lead to DoS. bsc1245573 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

PT-2025-32392 · Unknown +1 · Ajaxplorer/Pydio Cells +1

Name of the Vulnerable Software and Affected Versions: AjaXplorer/Pydio Cells versions prior to 2.6 Description: An unauthenticated remote command execution vulnerability exists due to improper sanitization of user-supplied input to the destServer GET parameter within the checkInstall.php script ...

CVE-2025-51970

A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter...

[SECURITY] [DLA 4242-1] angular.js security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4242-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès July 20, 2025 https://wiki.debian.org/LTS -...

Cross-Site Scripting (XSS)

ag-grid is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of grid contents, which allows an attacker to execute arbitrary JavaScript when user input is rendered in the grid...

OS Command Injection

james-heinrich/phpthumb is vulnerable to OS Command Injection. The vulnerability is due to improper sanitization of crafted parameter values in phpthumb.gif.php, which allows an attacker to execute arbitrary operating system commands...

CVE-2025-20319

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability editscripted and listinputs capability , could perform a remote command execution due to improper user input sanitization on the scripted input files.See Define...

Stored Cross-site Scripting (XSS)

File Browser is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of Markdown content, allowing JavaScript code in uploaded Markdown files to be executed by the browser...

PT-2025-26646 · Unknown · Htmlsanitizer.Jl

Name of the Vulnerable Software and Affected Versions: HTMLSanitizer.jl versions prior to 0.2.1 Description: The issue is related to improper HTML sanitization in HTMLSanitizer.jl, a Whitelist-based HTML sanitizer. When the style tag is added to the whitelist, content inside the tag is incorrectl...

CVE-2025-52557

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...

CVE-2025-52557

Summary: CVE-2025-52557 affects Mail-0’s Zero Email Solution, specifically version 0.8, due to improper sanitization in email handling which enables an attacker to craft an email that executes JavaScript and can cause session hijacking. Root cause: stored XSS stemming from insufficient sanitizati...

CVE-2025-52557 Mail-0 Zero Session Hijacking Via Email

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...

CVE-2025-5209

The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2025-5760

The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the appenddebuginfotocontext function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $POST and...

CVE-2025-5760

The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the appenddebuginfotocontext function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $POST and...

CVE-2025-5760

CVE-2025-5760 (WordPress Simple History plugin) exposes passwords via logs when Detective Mode is on. In affected versions prior to 5.8.1, append_debug_info_to_context() sanitization is insufficient, causing the plugin to log entire $_POST (and sometimes raw request bodies or $_GET) including pas...

CVE-2025-5760 Simple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode

The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the appenddebuginfotocontext function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $POST and...