CVE-2024-6129

A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Username Handler. The manipulation of the argument email leads to observable behavioral discrepancy. It is possible to launch the attack...

CVE-2024-31384

Cross-Site Request Forgery CSRF vulnerability in Rara Theme Spa and Salon.This issue affects Spa and Salon: from n/a through 1.2.7...

CVE-2023-43148

SPA-Cart 1.9.0.3 has a Cross Site Request Forgery CSRF vulnerability that allows a remote attacker to delete all accounts...

CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the...

CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the...

CVE-2025-43864

CVE-2025-43864: React Router (versions 7.2.0–7.5.1) allows forcing SPA mode by a request header, which on SSR apps can trigger a page-corrupting error. If a cache stores the error response, this enables cache poisoning and degrades availability. Patch: upgrade to React Router 7.5.2 (or later).

react-router 安全漏洞

react-router is a declarative routing for React open-sourced by Remix. A security vulnerability exists in react-router versions prior to 7.2.0 through 7.5.2, which stems from potentially forcing an application to switch to SPA mode by adding a request header, which could lead to cache poisoning...

PT-2025-17867

Name of the Vulnerable Software and Affected Versions React Router versions 7.2.0 through 7.5.2 Description The issue allows an attacker to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an erro...

PT-2025-16510 · Burgersoftware · Spabiz

Name of the Vulnerable Software and Affected Versions: burgersoftware SpaBiz versions 1.0.0 through 1.0.18 Description: The issue is related to improper neutralization of input during web page generation, which allows DOM-Based Cross-site Scripting XSS. This means that an attacker could potential...

MAL-2025-2261 Malicious code in init-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b819e1e4ec37a2916d54fc1cccc8d0a57a4c0fc53653d0caf06fe86826f0992b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cpp-spa-loginad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2071430481129f44784f3feac01baf6baa6ab03ebf6855bd2231bc91594038d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2247 Malicious code in cpp-spa-loginad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2071430481129f44784f3feac01baf6baa6ab03ebf6855bd2231bc91594038d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-270 Malicious code in aem-spa-component-mapping (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b1b3d4405a0ea27ac00cb9f96e4e70aa642f96018fa9b52508da4e98f1a6cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aem-spa-page-model-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f616d81322d87ec1a782a237c4b35c53512cc3e470b9fddd65db49c0c14d1425 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aem-react-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54bb39f84add565409123e2afb033f2b001ab42f9fde0cdb31e4927d222e1419 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12133 Malicious code in aem-react-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54bb39f84add565409123e2afb033f2b001ab42f9fde0cdb31e4927d222e1419 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11795 Malicious code in pacbot-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2527f33d46883eac958d98baa0937139f8988ddc5f7803d5764921761ddf4e3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pacbot-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2527f33d46883eac958d98baa0937139f8988ddc5f7803d5764921761ddf4e3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-2941 Malicious code in react-spa (npm)

False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...

CVE-2024-6129

A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Username Handler. The manipulation of the argument email leads to observable behavioral discrepancy. It is possible to launch the attack...