EUVD-2024-19967

Malicious code in bioql PyPI...

EUVD-2024-0940

Malicious code in bioql PyPI...

EUVD-2025-20458

Malicious code in bioql PyPI...

EUVD-2023-46481

Malicious code in bioql PyPI...

EUVD-2023-0924

Malicious code in bioql PyPI...

EUVD-2025-9294

Malicious code in bioql PyPI...

EUVD-2022-29672

Malicious code in bioql PyPI...

EUVD-2023-43064

Malicious code in bioql PyPI...

CVE-2025-60453

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, specifically in the app\system\column\admin\index.class.php component. The vulnerability allows attackers to upload malicious SVG files...

CVE-2025-60454

MetInfo CMS version 8.0 is affected by a stored Cross-Site Scripting (XSS) vulnerability within the image management module , specifically the app emg humb humb.php (referenced in some contexts as app emg humb humb.php or app emg humb humb.php but explicitly identified in these documents as ap...

CVE-2025-59773: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and...

CVE-2025-57873: Improper Neutralization of Input During Web Page Generation

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser...

CVE-2025-57877: Improper Neutralization of Input During Web Page Generation

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser...

PT-2025-55103

Уязвимость системы контроля доступа PERCo-Web связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный JavaScript-код...

CVE-2025-59528

Flowise 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig string is parsed and passed to the Function() constructor via convertToValidJSONString without validation, allowing an attacker to execute arbitrary JavaScript with Node.js privileges (e.g., ac...

CVE-2025-59430: Improper Neutralization of Input During Web Page Generation

Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically...

PT-2025-55118

Уязвимость системы управления знаниями NaumenKMS связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный JavaScript-код...

PT-2025-55119

Уязвимость библиотеки pdf.js системы управления знаниями NaumenKMS связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный JavaScript-код...

3DAlloy 跨站脚本漏洞

3DAlloy is a lightweight 3D viewer from the individual developer Maxim Martynov. A cross-site scripting vulnerability exists in 3DAlloy 1.8 and earlier versions, which stems from not cleaning up a custom attribute on the canvas HTML element and could lead to the execution of arbitrary JavaScript...

Flowise JS Injection RCE

This module exploits a remote code execution vulnerability in Flowise versions = 2.2.7-patch.1 and = 3.0.1, authentication via FLOWISEEMAIL and FLOWISEPASSWORD is required due to JWT token verification. Module Options msf use exploit/multi/http/flowise/jsrce msf undefinedjsrce show actions...