819 matches found
EUVD-2025-203312
MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...
CVE-2025-67898
MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...
CVE-2025-66554
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked ...
CVE-2025-66554
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked ...
PT-2025-49300
Name of the Vulnerable Software and Affected Versions Nextcloud Contacts app versions prior to 5.5.4 Nextcloud Contacts app versions prior to 6.0.6 Nextcloud Contacts app versions prior to 7.2.5 Description A malicious user could modify the organisation and title fields to load additional CSS...
EUVD-2025-198180
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript...
Path Traversal
Liferay Portal is vulnerable to path traversal. The vulnerability is due to improper validation of query strings in the ComboServlet, which allows an attacker to access arbitrary CSS/JS files and repeatedly load them to exploit the system...
EUVD-2025-178285
Malicious code in javascript-css-minimizer-webpack-plugin-geochronology-foundation npm...
EUVD-2025-176109
Malicious code in supernova-hyperion-tailwindcss-optimize-css-assets-webpack-plugin npm...
EUVD-2025-176856
Malicious code in quark-eslint-config-materialize-css-loader npm...
EUVD-2025-112003
Malicious code in karma-heka-shelljs-css-minimizer-webpack-plugin npm...
EUVD-2025-124054
Malicious code in optimize-css-assets-webpack-plugin-perseus-altair-restart npm...
EUVD-2025-115987
Malicious code in bootstrap-optimize-css-assets-webpack-plugin-jupiter-unuk npm...
EUVD-2025-111314
Malicious code in meissa-css-minimizer-webpack-plugin-kinetic-apex npm...
EUVD-2025-116536
Malicious code in arcturus-chakra-ui-css-loader-gemini npm...
EUVD-2025-122162
Malicious code in sedna-command-optimize-css-assets-webpack-plugin-eslint npm...
EUVD-2025-124661
Malicious code in mysql-optimize-css-assets-webpack-plugin-castor-css-minimizer-webpack-plugin npm...
DLA-4333-1 php-horde-css-parser - security update
Bulletin has no description...
Too salty to handle: Exposing cases of CSS abuse for hidden text salting
Cisco Talos has been closely monitoring the abuse of cascading style sheets CSS properties to include irrelevant content or salt in different parts of messages, a technique known as hidden text salting. This blog is a follow-up to our previous reports in January and March 2025 on CSS abuse in...