635 matches found
CVE-2025-64495
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is...
CVE-2025-63785
A DOM-based Cross-Site Scripting XSS vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because user-supplied input is not properly sanitized before being directly injected into the DOM via innerHTML when editing a text element. An...
CVE-2025-64495: Improper Neutralization of Input During Web Page Generation
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is...
EUVD-2025-38263
A DOM-based Cross-Site Scripting XSS vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because user-supplied input is not properly sanitized before being directly injected into the DOM via innerHTML when editing a text element. An...
PT-2025-45527
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.34 and below Description Open WebUI, a self-hosted artificial intelligence platform designed for offline operation, contains a Stored DOM XSS issue. When the 'Insert Prompt as Rich Text' functionality is enabled, the...
CVE-2025-63785
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Onlook web application version 0.2.32 within the text editor feature . The root cause is the lack of proper sanitization of user-supplied input before it is directly injected into the DOM using innerHTML when editing a text elemen...
CVE-2025-63785: Improper Input Validation
A DOM-based Cross-Site Scripting XSS vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because user-supplied input is not properly sanitized before being directly injected into the DOM via innerHTML when editing a text element. An...
CVE-2025-63785
A DOM-based Cross-Site Scripting XSS vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because user-supplied input is not properly sanitized before being directly injected into the DOM via innerHTML when editing a text element. An...
GHSA-G955-VW6W-V6PP Citizen vulnerable to stored XSS in sticky header button messages
Summary The JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages. Details In the copyButtonAttributes function in stickyHeader.js, when copying the button labels, the innerHTML of the new...
CVE-2025-62508 Citizen vulnerable to stored XSS in sticky header button messages
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s...
EUVD-2010-1256
Malware in sbrugna...
EUVD-2012-2570
Malware in sbrugna...
EUVD-2020-0615
Malware in sbrugna...
EUVD-2024-26188
Malicious code in bioql PyPI...
EUVD-2025-28574
Malicious code in bioql PyPI...
EUVD-2025-15174
Malicious code in bioql PyPI...
EUVD-2025-27502
Malicious code in bioql PyPI...
EUVD-2025-29217
Malicious code in bioql PyPI...
EUVD-2024-54618
Malicious code in bioql PyPI...
PT-2025-39430
Name of the Vulnerable Software and Affected Versions vulnerability-lookup version 2.16.0 Description A cross-site scripting XSS issue exists in the handling of user-supplied input within the Bundles, Comments, and Sightings components of the software. Untrusted data was not properly sanitized...