236 matches found
CVE-2026-24037 Horilla HRM has XSS Bypass through Project Name
Horilla is a free and open source Human Resource Management System HRMS. In version 1.4.0, the hasxss function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to...
CVE-2026-24037 Horilla HRM has XSS Bypass through Project Name
Horilla is a free and open source Human Resource Management System HRMS. In version 1.4.0, the hasxss function attempts to block XSS by matching input against a set of regex patterns. However, the regexes are incomplete and context-agnostic, making them easy to bypass. Attackers are able to...
CVE-2026-24037
Horilla HRMS has_XSS bypass in version 1.4.0 due to incomplete, context-agnostic regex filtering in has_xss(), enabling attackers to redirect users, run external JavaScript, and steal CSRF tokens for admin-targeted CSRF attacks. The issue is fixed in version 1.5.0. Affected: Horilla 1.4.x → fixed...
CVE-2019-20008
In Archery before 1.3, inserting an XSS payload into a project name either by creating a new project or editing an existing one will result in stored XSS on the vulnerability-scan scheduling page...
CVE-2025-59158 Coolify has Stored XSS in Project Name
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges e.g....
CVE-2025-59158
CVE-2025-59158 affects Coolify, a self-hosted application management platform. Version scope: vulnerable when using versions up to and including v4.0.0-beta.420.6; a stored cross-site scripting (XSS) flaw exists in the project creation workflow. An authenticated user with low privileges (e.g., me...
CVE-2025-59158 Coolify has Stored XSS in Project Name
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting XSS attack in the project creation workflow. An authenticated user with low privileges e.g....
PT-2026-1314
Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.420.7 Description Coolify is a self-hostable tool for managing servers, applications, and databases. A stored cross-site scripting XSS issue exists in the project creation workflow. An authenticated user wi...
Soft Serve does not sanitize ANSI escape sequences in user input
Impact In several places where the user can insert data e.g. names, ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. Places in which this was found: 1. Repository...
GHSA-FV2R-R8MP-PG48 Soft Serve does not sanitize ANSI escape sequences in user input
Impact In several places where the user can insert data e.g. names, ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. Places in which this was found: 1. Repository...
CVE-2025-62528 Taguette cross-site scripting vulnerability via tag name, tag description, document name and document description
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0...
EUVD-2008-6906
Malware in sbrugna...
EUVD-2019-0105
Malware in sbrugna...
EUVD-2013-1926
Malware in sbrugna...
EUVD-2013-7035
Malware in sbrugna...
EUVD-2020-7584
Malware in sbrugna...
EUVD-2025-27113
Malicious code in bioql PyPI...
EUVD-2023-1906
Malicious code in bioql PyPI...