70 matches found
wonitor
web monitor fast, zero config web endpoint change monitor. for comparing responses, a selected list of http headers and the full response body is stored on a local key/value store file. no configuration needed. to increase network throughput, a --worker flag allows to set the concurrency when...
CVE-2026-117493
Stored cross-site scripting XSS in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information...
CVE-2026-117493 Multiple vulnerabilities in Sisense’s Cloud BI Platform
Stored cross-site scripting XSS in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information...
CVE-2026-117493
Sisense's Cloud BI Platform is vulnerable to Stored Cross-Site Scripting (XSS) in BloX widgets . The /api/dashboards//widgets/ API fails to properly sanitize HTML and JavaScript content submitted via the desc and text parameters. When a widget is rendered, the injected code executes in the user's...
PT-2026-125901
Stored cross-site scripting XSS in BloX widgets. The /api/dashboards//widgets/ API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information...
EUVD-2026-45207
A stored cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997 within the voicemail notification template functionality. The submitmodifyvoicemailtemplate endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious...
Open WebUI allows limited stored XSS vila uploaded html file
SummaryLow privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...
Cross-User Data Leakage
jsPDF is vulnerable to Cross-User Data Leakage. The vulnerability is due to use of a shared module-scoped variable in the addJS method, where JavaScript content is stored globally in the Node.js build, allowing concurrent PDF generation requests to overwrite each other’s data and cause one user’s...
CVE-2025-35060
Newforma Info Exchange NIX provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent...
CVE-2025-61999
OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a logo. Injected content is executed in the context of other users when they view affected pages. Successful exploitation allows the administrative user to perfo...
EUVD-2023-52497
Malicious code in bioql PyPI...
EUVD-2023-52545
Malicious code in bioql PyPI...
EUVD-2024-23409
Malicious code in bioql PyPI...
EUVD-2022-7259
Malicious code in bioql PyPI...
EUVD-2023-52587
Malicious code in bioql PyPI...
EUVD-2023-42164
Malicious code in bioql PyPI...
EUVD-2023-52502
Malicious code in bioql PyPI...
EUVD-2023-52669
Malicious code in bioql PyPI...
EUVD-2024-52256
Malicious code in bioql PyPI...
CVE-2025-46857
Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If a low privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...