CVE-2025-10088

CVE-2025-10088 affects SourceCodester Time Tracker 1.0. An unknown function in /index.html is vulnerable when manipulating the project-name parameter, enabling cross-site scripting that could be triggered remotely. Exploit is publicly available (PoC). A practical interim mitigation from PT-2025-3...

PT-2025-36446

Name of the Vulnerable Software and Affected Versions: SourceCodester Time Tracker version 1.0 Description: A cross-site scripting XSS vulnerability exists due to manipulation of the project-name argument. The vulnerability affects an unknown function within the /index.html file. The exploit is...

CVE-2025-34157 Coolify Stored Cross-Site Scripting (XSS) in Project Name Field

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to...

CVE-2025-34157 Coolify Stored Cross-Site Scripting (XSS) in Project Name Field

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to...

CVE-2025-34157

CVE-2025-34157 concerns Coolify. A stored XSS in the project-creation workflow affects versions prior to 4.0.0-beta.420.6. An authenticated user with low privileges can craft a project name containing JavaScript, which when an administrator deletes the project executes in the admin context, enabl...

Malicious code in project-eh7vv-yankee (npm)

The package project-eh7vv-yankee was found to contain malicious code...

Malicious code in xylophone-brook-uti375-project (npm)

The package xylophone-brook-uti375-project was found to contain malicious code...

Malicious code in umbra-tide-ehe932-project (npm)

The package umbra-tide-ehe932-project was found to contain malicious code...

MAL-2025-30084 Malicious code in project-d56rk-zucchini (npm)

The package project-d56rk-zucchini was found to contain malicious code...

Malicious code in project-yl4sx-lemon (npm)

The package project-yl4sx-lemon was found to contain malicious code...

Malicious code in icicle-jade-ysp547-project (npm)

The package icicle-jade-ysp547-project was found to contain malicious code...

Malicious code in dewdrop-kite-tea960-project (npm)

The package dewdrop-kite-tea960-project was found to contain malicious code...

MAL-2025-27960 Malicious code in nymph-nectar-pel131-project (npm)

The package nymph-nectar-pel131-project was found to contain malicious code...

MAL-2025-30371 Malicious code in project-mwi5v-mike (npm)

The package project-mwi5v-mike was found to contain malicious code...

MAL-2025-29835 Malicious code in project-4h5ip-ugli (npm)

The package project-4h5ip-ugli was found to contain malicious code...

Malicious code in project-fbywc-mango (npm)

The package project-fbywc-mango was found to contain malicious code...

CVE-2024-25218

A cross-site scripting XSS vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php...

CVE-2022-32567

The Appfire Jira Misc Custom Fields JMCF app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule function...

CVE-2022-32274

The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function...

CVE-2021-45456

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass...