MAL-2025-4724 Malicious code in next-pwa-template (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 598361c7d39c208feedabd0f7d7e0b666d50ad75fa8f2c7db2a64654e3c6a194 Any computer that has this package installed or running should be considered...

vuejs Vue CLI 安全漏洞

vuejs Vue CLI is a webpack-based Vue.js development tool open-sourced by Vue. A security vulnerability exists in vuejs Vue CLI version 5.0.8 and earlier, which stems from an inefficient regular expression complexity in the function HtmlPwaPlugin...

CVE-2024-8967

The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2021-24906

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin and therefore the protection offered via a crafted request...

Researchers Expose PWA JavaScript Attack That Redirects Users to Adult Scam Apps

Cybersecurity researchers have discovered a new campaign that employs malicious JavaScript injections to redirect site visitors on mobile devices to a Chinese adult-content Progressive Web App PWA scam. "While the payload itself is nothing new yet another adult gambling scam, the delivery method...

CVE-2024-7759

The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-7759 PWA For WP & AMP < 1.7.72 Administrator+ Stored XSS

The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-7759 PWA For WP & AMP < 1.7.72 Administrator+ Stored XSS

The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-7759

The CVE-2024-7759 entry applies to the WordPress plugin “PWA for WP” (WordPress plugin) versions prior to 1.7.72. The issue is due to insufficient sanitisation/escaping of some settings, enabling Stored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., admins) even when unfiltered_...

WordPress plugin PWA for WP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-21501 · WordPress · Pwa For Wp

Name of the Vulnerable Software and Affected Versions: The PWA for WP WordPress plugin versions prior to 1.7.72 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and...

CVE-2021-4354

The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwpsplashscreenuploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites...

The vulnerability in the Advanced PWA module of the Drupal CMS system, related to incorrect authentication, allows a hacker to bypass security restrictions and execute a Forceful Browsing attack.

The vulnerability of the Advanced PWA module in Drupal’s Push Notifications CMS system is related to improper authentication. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

CVE-2024-13253

Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0...

CVE-2024-13253 Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017

Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0...

CVE-2024-13253 Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017

Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0...

CVE-2024-13253

CVE-2024-13253 affects Drupal Advanced PWA inc Push Notifications. Affected versions range from 0.0.0 to before 1.5.0; the root cause is an Incorrect Authorization vulnerability that enables forceful browsing. A fixed version is 1.5.0 or later. Remediation: upgrade to 1.5.0+ or apply vendor guida...

CVE-2024-47318

Missing Authorization vulnerability in Magazine3 PWA for WP & AMP pwa-for-wp.This issue affects PWA for WP & AMP: from n/a through = 1.7.72...

CVE-2024-47318 WordPress PWA for WP & AMP plugin <= 1.7.72 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magazine3 PWA for WP & AMP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PWA for WP & AMP: from n/a through 1.7.72...

CVE-2024-47318 WordPress PWA for WP & AMP plugin <= 1.7.72 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magazine3 PWA for WP & AMP pwa-for-wp.This issue affects PWA for WP & AMP: from n/a through = 1.7.72...