PYSEC-2026-2744 Open WebUI has stored XSS in Excel file preview

Summary Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheettohtml to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger. Details The...

CVE-2023-29772

A Cross-site scripting XSS vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC51U wireless router firmware version up to and including 3.0.0.4.380.8591 allows remote attackers to inject arbitrary web script or HTML via a malicious network request...

CVE-2022-31205

In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol without any further authentication...

EUVD-2016-4011

Malware in sbrugna...

EUVD-2011-2589

Malware in sbrugna...

EUVD-2017-10437

Malware in sbrugna...

EUVD-2016-7476

Malware in sbrugna...

EUVD-2018-12491

Malware in sbrugna...

EUVD-2014-9499

Malware in sbrugna...

EUVD-2019-13995

Malware in sbrugna...

EUVD-2021-16274

Malware in sbrugna...

EUVD-2016-6914

Malware in sbrugna...

EUVD-2016-7059

Malware in sbrugna...

EUVD-2024-45784

Malicious code in bioql PyPI...

EUVD-2025-19598

Malicious code in bioql PyPI...

CVE-2025-53096

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. ...

CVE-2025-53095

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Forgery CSRF attacks. This vulnerability allows an attacker to craft a malicious web page that, when visited by an authenticated user, can...

CVE-2025-53095 Sunshine application-wide CSRF in the UI leads to command injection as Administrator

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Forgery CSRF attacks. This vulnerability allows an attacker to craft a malicious web page that, when visited by an authenticated user, can...

CVE-2025-53096 Sunshine clickjacking in the UI leads to unauthorized actions being performed

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. ...

PT-2025-27495 · Ibm · Ibm System Storage Virtualization Engine Ts7700 +2

Name of the Vulnerable Software and Affected Versions: IBM System Storage Virtualization Engine TS7700 versions 8.54.2.17 through 8.60.0.115 IBM System Storage Virtualization Engine 3948 VED versions 8.54.2.17 through 8.60.0.115 IBM System Storage Virtualization Engine 3948 VEF version 8.60.0.115...