CVE-2025-23292: Improper Neutralization of Special Elements in Data Query Logic

NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to partial denial of service UI component...

CVE-2025-8681

Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. Requires a high privileged user with a developer role...

CVE-2025-8681

Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. Requires a high privileged user with a developer role...

CVE-2025-8681 Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component

Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. Requires a high privileged user with a developer role...

PT-2025-37077

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 7.1.0 through 24.2.2 Description: Pega Platform is affected by a Stored Cross-Site Scripting XSS issue within a user interface component. Exploitation requires a user with high privileges and a developer role...

Malicious code in generator-react-ui-component (npm)

The package generator-react-ui-component was found to contain malicious code...

Malicious code in respace-ui-component-picker (npm)

The package respace-ui-component-picker was found to contain malicious code...

MAL-2025-21300 Malicious code in generator-react-ui-component (npm)

The package generator-react-ui-component was found to contain malicious code...

CVE-2025-53834

Caido is a web security auditing toolkit. A reflected cross-site scripting XSS vulnerability was discovered in Caido’s toast UI component in versions prior to 0.49.0. Toast messages may reflect unsanitized user input in certain tools such as Match&Replace and Scope. This could allow an attacker t...

CVE-2025-53834

Caido Toast XSS (CVE-2025-53834): A reflected XSS vulnerability exists in Caido’s toast UI component in versions before 0.49.0, where unsanitized user input reflected in tools like Match&Replace and Scope can lead to arbitrary script execution. The issue is fixed in version 0.49.0. Affected produ...

CVE-2025-53834 Caido Toast Vulnerable to Reflected Cross-site Scripting

Caido is a web security auditing toolkit. A reflected cross-site scripting XSS vulnerability was discovered in Caido’s toast UI component in versions prior to 0.49.0. Toast messages may reflect unsanitized user input in certain tools such as Match&Replace and Scope. This could allow an attacker t...

PT-2025-29521 · Caido · Caido

Name of the Vulnerable Software and Affected Versions: Caido versions prior to 0.49.0 Description: Caido is a web security auditing toolkit. A reflected cross-site scripting XSS issue exists in Caido’s toast UI component. Toast messages may reflect unsanitized user input in tools like Match&Repla...

CVE-2022-47500

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrad...

CVE-2025-4318 Input validation issue in AWS Amplify Studio UI component properties

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build...

CVE-2025-4318

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build...

CVE-2025-4318: Improper Neutralization of Directives in Dynamically Evaluated Code

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build...

@acronis-platform/ui-component-library (1.33.0), @elasticview/plugin-sdk (>=1.0.0, <=1.0.18) +28 more potentially affected by CVE-2025-27597 via vue-i18n (>=10.0.0-beta.5, <=10.0.5)

vue-i18n NPM version =10.0.0-beta.5, =1.0.0, =0.0.16, =2.4.8, =3.0.0, =4.0.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.13.0 and more Source cves: CVE-2025-27597 Source advisory: MEND:CVE-2025-27597...

Malicious code in aws-ui-component-select (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dccf55adacf1d8f07bd95ddca3f474ac9b53ffa48455ff2cbb23352bd0055add Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2092 Malicious code in aws-ui-component-select (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dccf55adacf1d8f07bd95ddca3f474ac9b53ffa48455ff2cbb23352bd0055add Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Security SOAR is vulnerable to client-side vulnerability (CVE-2024-45801)

Summary IBM Security SOAR was using a UI component which contained a vulnerability that could lead to a client-side arbitrary code execution CVE-2024-45801. The vulnerable component has been removed from the UI. Please upgrade to IBM Security SOAR version 51.0.4.0 or later. Vulnerability Details...