953 matches found
PT-2025-18187
Name of the Vulnerable Software and Affected Versions AngularJS versions prior to the end of life, as no specific fixed version is mentioned and the project is End-of-Life. Description The issue is related to improper sanitization of the href and xlink:href attributes in SVG elements, allowing...
Cross-Site Scripting (XSS)
@sveltejs/kit is vulnerable to cross-site scripting XSS. The vulnerability is due to improper sanitization of search parameter names when iterating over event.url.searchParams in server load functions, allowing attackers to inject malicious scripts via crafted URLs...
CVE-2025-30511
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant...
CVE-2025-30511
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant...
CVE-2025-30511 Growatt Cloud Applications Cross-site Scripting
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant...
CVE-2025-30511 Growatt Cloud Applications Cross-site Scripting
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant...
Cross-site Scripting (XSS)
Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the Navigation/Title Text/Description Source argument due to improper sanitization. Details Cross-site scripting or XSS is a code...
CVE-2024-9016
man-group dtale version = 3.13.1 contains a vulnerability where the query parameters from the request are directly passed into the runquery function without proper sanitization. This allows for unauthenticated remote command execution via the df.query method when the query engine is set to 'pytho...
CVE-2024-9107 Stored XSS in gaizhenbiao/chuanhuchatgpt
A stored cross-site scripting XSS vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, affecting version git 20b2e02. The vulnerability arises from improper sanitization of HTML tags in chat history uploads. Specifically, the sanitization logic fails to handle HTML tags within code...
CVE-2024-11170 Path Traversal in danny-avila/librechat
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6...
tuned security update
An update is available for tuned. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The tuned packages provide a service that tunes system settings according to a...
RLSA-2024:10384 Important: tuned security update
The tuned packages provide a service that tunes system settings according to a selected profile. Security Fixes: tuned: scriptpre and scriptpost options allow to pass arbitrary scripts executed by root CVE-2024-52336 tuned: improper sanitization of instancename parameter of the instancecreate...
Cross-site Scripting (XSS)
Overview modx/revolution is a Content Management System. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of user-uploaded SVG files in the profile image upload feature. Authenticated users can upload SVG files containing malicious JavaScri...
Cross-site Scripting (XSS)
Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the group argument in the Settings Handler due to improper sanitization before being rendered on the page. Details...
Stored Cross-site Scripting (XSS)
github.com/matrix-org/pinecone is vulnerable to stored Stored Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user input, allowing malicious scripts to be stored and later executed when accessed by users...
Authentication Credential Leakage
URI is vulnerable to authentication credential leakage. The vulnerability is due to improper sanitization of userinfo in URI handling methods, allowing an attacker to extract credentials and potentially gain unauthorized access...
CVE-2025-25461
CVE-2025-25461 affects SeedDMS 6.0.29. A stored XSS flaw exists in the category-name field: a user with Add Category permission can inject payloads that are stored server-side and rendered unencoded when a document is viewed, allowing execution in other users’ browsers. The root cause is lack of ...
Moderate: Red Hat Security Advisory: tuned security update
An update for tuned is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...
Moderate: Red Hat Security Advisory: tuned security update
An update for tuned is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...