GHSA-3H6J-9X8M-RG3G Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config

Summary Graby's cleanupXss function configures htmLawed with conflicting settings: safe=1 which removes combined with 'elements' = '+iframe-meta' which re-enables . htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is render...

CVE-2023-4455

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...

EUVD-2023-2330

Malicious code in bioql PyPI...

EUVD-2023-0779

Malicious code in bioql PyPI...

EUVD-2023-0742

Malicious code in bioql PyPI...

EUVD-2023-2294

Malicious code in bioql PyPI...

EUVD-2023-1980

Malicious code in bioql PyPI...

EUVD-2024-3229

Malicious code in bioql PyPI...

EUVD-2022-4016

Malicious code in bioql PyPI...

EUVD-2025-29379

Malicious code in bioql PyPI...

EUVD-2023-0617

Malicious code in bioql PyPI...

EUVD-2023-0603

Malicious code in bioql PyPI...

EUVD-2023-0943

Malicious code in bioql PyPI...

CVE-2023-0735

Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-0734

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-0609

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2023-0610

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2023-0736

Cross-site Scripting XSS - Stored in GitHub repository wallabag/wallabag prior to 2.5.4...

CVE-2023-3566

A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of resources. The exploit has been disclosed ...

CVE-2023-0737

wallabag version 2.5.2 contains a Cross-Site Request Forgery CSRF vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4...