PT-2025-38692

Name of the Vulnerable Software and Affected Versions Markup Markdown WordPress plugin versions prior to 3.20.10 Description The plugin allows links to contain JavaScript, potentially enabling users with contributor or higher roles to carry out Stored Cross-Site Scripting attacks. Recommendations...

WordPress plugin Markup Markdown 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

WordPress Import Markdown Plugin <= 1.14 is vulnerable to Cross Site Scripting (XSS)

Software Import Markdown Type Plugin Vulnerable versions = 1.14 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-57901 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3d88e282a665 Credits minseok Kim Required privilege Contributo...

PT-2025-38691

Name of the Vulnerable Software and Affected Versions Markup Markdown WordPress plugin versions prior to 3.20.10 Description The plugin allows links to contain JavaScript, potentially enabling users with contributor or higher roles to execute Stored Cross-Site Scripting attacks. Recommendations...

编号撤回

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-39011

Name of the Vulnerable Software and Affected Versions DAEXT Import Markdown versions through 1.14 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a Stored Cross-Site Scripting XSS condition. This allows an attacker to...

WordPress plugin Markup Markdown 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

Security Bulletin: IBM Watsonx BI is affected by a vulnerability found in CodeMirror up to 5.17.0 and classified as problematic

Summary IBM Watsonx BI is affected by a vulnerability found in CodeMirror up to 5.17.0 and classified as problematic. Affected by this issue is some unknown functionality of the file mode/markdown/markdown.js of the component Markdown Mode. The manipulation leads to inefficient regular expression...

CVE-2025-59053

AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...

CVE-2025-59053

AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...

CVE-2025-59053 AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE

AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...

CVE-2025-59053

Affected software and version: AIRI v0.7.2-beta.2 (Grok Companion) with vulnerable Markdown rendering in packages/stage-ui/src/components/MarkdownRenderer.vue and insecure MCP command interface. Root cause: Markdown is processed via useMarkdown and rendered with v-html without escaping, enabling ...

CVE-2025-59053 AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE

AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...

CVE-2025-59053 AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE

AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...

Malicious Package

Overview react-markdown-v7 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2025-37257

Name of the Vulnerable Software and Affected Versions: AIRI versions 0.7.2-beta.2 Description: AIRI is a self-hosted, artificial intelligence based Grok Companion. The application processes Markdown content using the useMarkdown composable and renders it directly into the DOM using v-html. An...

Project AIRI 代码注入漏洞

Project AIRI is an AI dialog bot open-sourced by moeru-ai. Project AIRI version 0.7.2-beta.2 suffers from a code injection vulnerability that stems from the MarkdownRenderer.vue component directly using v-html to render unescaped HTML content, which could lead to cross-site scripting attacks, as...

Linux Distros Unpatched Vulnerability : CVE-2022-31175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions...

Linux Distros Unpatched Vulnerability : CVE-2021-21391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list,...

Linux Distros Unpatched Vulnerability : CVE-2023-6396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitlab reports: XSS and ReDoS in Markdown via Banzai pipeline of Jira Members with admingroupmember custom permission can add members with higher role Release...