PT-2025-7270

Name of the Vulnerable Software and Affected Versions WEEEK affected versions not specified Description The issue is related to the lack of protection of the web page structure, allowing an attacker to execute arbitrary JavaScript code. Recommendations At the moment, there is no information about...

PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class

Unauthorized Reflected XSS in the constructor of the Downloader class Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 8.2 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS vector v.4.0: 8.3...

GHSA-JMPX-686V-C3WX PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class

Unauthorized Reflected XSS in the constructor of the Downloader class Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 8.2 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS vector v.4.0: 8.3...

PT-2024-41191

Уязвимость системы автоматизации рекрутинговых процессов E-Staff связана с ошибками фильтрации данных при обновлении объектов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный JavaScript-код...

CVE-2024-55878

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct...

CVE-2024-55878 Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct...

Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper input sanitization when adding notes to a device, allowing JavaScript code in the notes to be triggered when the ExamplePlugin is enabled...

CVE-2024-49503: Improper Neutralization of Input During Web Page Generation

A Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials sub page. This issue affects Container suse/manager/5.0/x8664/server:5.0.2.7.8.1: before...

CVE-2024-46966

The Ikhgur mn.ikhgur.khotoch aka Video Downloader Pro & Browser application through 1.0.42 for Android allows an attacker to execute arbitrary JavaScript code via the mn.ikhgur.khotoch.MainActivity component...

CVE-2024-52286 Self Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDF

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes untrusted user input file name and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code...

PT-2024-32303

Name of the Vulnerable Software and Affected Versions Master Video Downloader versions through 2.0 Description The issue allows an attacker to execute arbitrary JavaScript code via the com.downloader.video.fast.SpeedMainAct component. Recommendations For Master Video Downloader versions through...

PT-2024-32307

Name of the Vulnerable Software and Affected Versions Ikhgur mn.ikhgur.khotoch aka Video Downloader Pro & Browser versions 1.0.42 and earlier Description The issue allows an attacker to execute arbitrary JavaScript code via the mn.ikhgur.khotoch.MainActivity component. This could potentially lead...

CVE-2024-46966: Improper Control of Generation of Code

The Ikhgur mn.ikhgur.khotoch aka Video Downloader Pro & Browser application through 1.0.42 for Android allows an attacker to execute arbitrary JavaScript code via the mn.ikhgur.khotoch.MainActivity component...

CVE-2024-46964: Improper Control of Generation of Code

The com.video.downloader.all aka All Video Downloader application through 11.28 for Android allows an attacker to execute arbitrary JavaScript code via the com.video.downloader.all.StartActivity component...

CVE-2024-46963: Improper Control of Generation of Code

The com.superfast.video.downloader aka Super Unlimited Video Downloader - All in One application through 5.1.9 for Android allows an attacker to execute arbitrary JavaScript code via the com.bluesky.browser.ui.BrowserMainActivity component...

PT-2024-32306

Name of the Vulnerable Software and Affected Versions allvideo.downloader.browser aka Fast Video Downloader: Browser versions 1.6-RC1 and earlier Description The issue allows an attacker to execute arbitrary JavaScript code via the allvideo.downloader.browser.DefaultBrowserActivity component. Thi...

PT-2024-32304

Name of the Vulnerable Software and Affected Versions com.superfast.video.downloader aka Super Unlimited Video Downloader - All in One versions 5.1.9 and earlier Description The issue allows an attacker to execute arbitrary JavaScript code via the com.bluesky.browser.ui.BrowserMainActivity...

PT-2024-32305

Name of the Vulnerable Software and Affected Versions All Video Downloader versions through 11.28 Description The issue allows an attacker to execute arbitrary JavaScript code via the com.video.downloader.all.StartActivity component. Recommendations For All Video Downloader versions through 11.28...

CVE-2024-46965: Improper Control of Generation of Code

The DS allvideo.downloader.browser aka Fast Video Downloader: Browser application through 1.6-RC1 for Android allows an attacker to execute arbitrary JavaScript code via the allvideo.downloader.browser.DefaultBrowserActivity component...

Inshot Video Downloader 安全漏洞

InShot Inshot Video Downloader is a video download application from InShot. A security vulnerability exists in Inshot Video Downloader version 1.3.5 and earlier, which stems from the presence of an arbitrary JavaScript code execution vulnerability...