1469 matches found
EUVD-2026-0937
Malicious code in @signify/vue-components npm...
MAL-2026-45 Malicious code in @signify/vue-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ff7ae41abedc64bde81c60772d7adf7e58c51a651ce76e0684c0ea713fe130d The package @signify/vue-components was found to contain malicious code. Source: ghsa-malware...
CVE-2025-15372
A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/index.vue of the component Notice Handler. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The...
CVE-2025-15372 youlaitech vue3-element-admin Notice index.vue cross site scripting
A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/index.vue of the component Notice Handler. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The...
CVE-2025-15372 youlaitech vue3-element-admin Notice index.vue cross site scripting
A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/index.vue of the component Notice Handler. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The...
CVE-2025-15372 youlaitech vue3-element-admin Notice index.vue cross site scripting
A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/index.vue of the component Notice Handler. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The...
CVE-2025-65442
DOM-based Cross-Site Scripting XSS vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information e.g., user session cookies via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage...
EUVD-2025-205582
DOM-based Cross-Site Scripting XSS vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information e.g., user session cookies via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage...
CVE-2025-65442
DOM-based Cross-Site Scripting XSS vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information e.g., user session cookies via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage...
CVE-2025-65442
The 201206030 novel V3.5.0 platform contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) within its book comment module. The root cause is the insufficient validation and encoding of user-controllable data: unfiltered input is stored in the book_comment table (field commentConte...
PT-2025-53724
Name of the Vulnerable Software and Affected Versions 201206030 novel version 3.5.0 Description A DOM-based Cross-Site Scripting XSS issue exists in the book comment module due to insufficient validation and encoding of user-controllable data. Unfiltered input is stored in the commentContent fiel...
CVE-2025-65442
DOM-based Cross-Site Scripting XSS vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information e.g., user session cookies via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage...
CVE-2025-65442
DOM-based Cross-Site Scripting XSS vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information e.g., user session cookies via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage...
GHSA-898P-HH3P-HF9R Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text
Gitea before 1.22.2 allows XSS because the search input box for creating tags and branches is v-html instead of v-text...
Malicious Package
Overview vue-nect is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious Package
Overview template-vue-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Cross-Site Scripting (XSS)
code16/sharp is vulnerable to Cross-Site Scripting XSS.The vulnerability is due to improper handling of expressions wrapped in & within the SharpShowTextField component, which are evaluated by Vue, allowing an attacker to inject and execute arbitrary JavaScript or HTML in a user’s browser when th...
SUSE CVE-2025-66410
Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder...
vuetify 安全漏洞
vuetify is a material component framework for Vue open-sourced by vuetify Germany. A security vulnerability exists in vuetify version 2.2.0-beta.2 through versions prior to 3.0.0-alpha.10, which stems from a prototype contamination in the Preset configuration, which could result in contaminating...