EUVD-2025-27113

Malicious code in bioql PyPI...

CVE-2025-10787 MuYuCMS Add Fiend Link index.html server-side request forgery

A vulnerability was found in MuYuCMS up to 2.7. Impacted is an unknown function of the file /index/index.html of the component Add Fiend Link Handler. Performing manipulation of the argument Link URL results in server-side request forgery. The attack may be initiated remotely. The exploit has bee...

CVE-2025-10088

A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation of the argument project-name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be us...

CVE-2025-10088

A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation of the argument project-name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be us...

CVE-2025-10088 SourceCodester Time Tracker index.html cross site scripting

A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation of the argument project-name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be us...

CVE-2025-10088 SourceCodester Time Tracker index.html cross site scripting

A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation of the argument project-name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be us...

CVE-2025-10088

CVE-2025-10088 affects SourceCodester Time Tracker 1.0. An unknown function in /index.html is vulnerable when manipulating the project-name parameter, enabling cross-site scripting that could be triggered remotely. Exploit is publicly available (PoC). A practical interim mitigation from PT-2025-3...

PT-2025-36446

Name of the Vulnerable Software and Affected Versions: SourceCodester Time Tracker version 1.0 Description: A cross-site scripting XSS vulnerability exists due to manipulation of the project-name argument. The vulnerability affects an unknown function within the /index.html file. The exploit is...

CVE-2023-28444

angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-server-side-configuration detects used environment variables in TypeScript .ts files during build time of an Angular CLI project. The...

JSite 安全漏洞

JSite is JSite open source a backend management system rapid development framework. A security vulnerability exists in JSite version 1.0, which stems from improper access control of the file /druid/index.html...

CVE-2025-29306

An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component...

CVE-2025-26206

Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component...

CVE-2025-26206

CVE-2025-26206 concerns a Cross-Site Request Forgery (CSRF) vulnerability in Sell Done Storefront v1.0. The issue stems from the absence of anti-CSRF protections in the web application, allowing a remote attacker to induce privileged actions via the index.html component. Affected code is identifi...

storefront 跨站请求伪造漏洞

storefront is a SaaS solution open-sourced by Selldone. A security vulnerability exists in storefront v.1.0, which stems from a cross-site request forgery in the index.html component that could lead to elevation of privilege...

CVE-2025-0228

A vulnerability has been found in code-projects Local Storage Todo App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /js-todo-app/index.html. The manipulation of the argument Add leads to cross site scripting. The attack can be initiated remotely. The...

Code-Projects Local Storage Todo App 代码注入漏洞

Code-Projects Local Storage Todo App is an open source local code storage project by Code-Projects. A code injection vulnerability exists in Code-Projects Local Storage Todo App version 1.0, which originates from a cross-site scripting vulnerability contained in the Add parameter in the...

PT-2024-38952 · Sourcecodester · Sourcecodester Contact Manager With Export To Vcf

Name of the Vulnerable Software and Affected Versions: SourceCodester Contact Manager with Export to VCF version 1.0 Description: A problematic issue has been found, affecting some unknown functionality of the file index.html. The manipulation of the contact name argument leads to cross-site...

YznCMS 安全漏洞

YznCMS is a backend development framework. A cross-site scripting vulnerability exists in YznCMS version 1.4.2, which stems from the lack of effective filtering and escaping of user-supplied data in the component /index/index.html, and can be exploited by an attacker to execute arbitrary Web scri...

PT-2024-27716 · Unknown · Shanxi Internet Chuangxiang Technology Co.

Name of the Vulnerable Software and Affected Versions: Shanxi Internet Chuangxiang Technology Co., Ltd version 1.0.1 Description: The background management system has an issue that allows a remote attacker to cause a denial of service via the index.html component. Recommendations: For version...

go2rtc 跨站脚本漏洞

go2rtc is an ultimate camera streaming application by Alex X Personal Developer that supports RTSP, RTMP, HTTP-FLV, WebRTC, MSE, HLS, MP4, MJPEG, HomeKit, FFmpeg and more. A cross-site scripting vulnerability exists in go2rtc 1.8.5 and earlier versions, which stems from the name parameter in...