Malicious code in project-yl4sx-lemon (npm)

The package project-yl4sx-lemon was found to contain malicious code...

Malicious code in icicle-jade-ysp547-project (npm)

The package icicle-jade-ysp547-project was found to contain malicious code...

Malicious code in xylophone-brook-uti375-project (npm)

The package xylophone-brook-uti375-project was found to contain malicious code...

MAL-2025-30084 Malicious code in project-d56rk-zucchini (npm)

The package project-d56rk-zucchini was found to contain malicious code...

MAL-2025-27960 Malicious code in nymph-nectar-pel131-project (npm)

The package nymph-nectar-pel131-project was found to contain malicious code...

Malicious code in project-fbywc-mango (npm)

The package project-fbywc-mango was found to contain malicious code...

MAL-2025-29835 Malicious code in project-4h5ip-ugli (npm)

The package project-4h5ip-ugli was found to contain malicious code...

MAL-2025-30371 Malicious code in project-mwi5v-mike (npm)

The package project-mwi5v-mike was found to contain malicious code...

CVE-2024-25218

A cross-site scripting XSS vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php...

CVE-2022-32567

The Appfire Jira Misc Custom Fields JMCF app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule function...

CVE-2022-32274

The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function...

CVE-2021-45456

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass...

CVE-2021-24382

The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of th...

CVE-2025-46825 Kanboard has stored Cross-site Scripting vulnerability in project name

Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting XSS Vulnerability in the name parameter of the http://localhost/?controller=ProjectCreationController&action=create form. This vulnerability allows...

CVE-2025-46825 Kanboard has stored Cross-site Scripting vulnerability in project name

Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting XSS Vulnerability in the name parameter of the http://localhost/?controller=ProjectCreationController&action=create form. This vulnerability allows...

Improper Ownership Management

Overview github.com/rancher/rancher/pkg/apis/management.cattle.io/v3 is a complete container management platform Affected versions of this package are vulnerable to Improper Ownership Management for projects, whose namespace defaults to being the project name, regardless of cluster. A user with...

Improper Ownership Management

Overview github.com/rancher/rancher/pkg/controllers/managementuser/secret is a project that provides a container management platform built for organizations that deploy containers in production Affected versions of this package are vulnerable to Improper Ownership Management for projects, whose...

Improper Ownership Management

Overview Affected versions of this package are vulnerable to Improper Ownership Management for projects, whose namespace defaults to being the project name, regardless of cluster. A user with permission to create a project can escalate privileges to those of a user who owns a project by the same...

CVE-2024-5752

A path traversal vulnerability exists in stitionai/devika, specifically in the project creation functionality. In the affected version beacf6edaa205a5a5370525407a6db45137873b3, the project name is not validated, allowing an attacker to create a project with a crafted name that traverses...

CVE-2024-5926

A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service DoS. This issue is present in all versions of the application. The vulnerability arises due to insufficient path...