11751 matches found
PT-2026-114205
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...
CVE-2026-54702: Exposed Dangerous Method or Function
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...
CVE-2026-54701: Improper Neutralization of Input During Web Page Generation
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document withou...
Yiyi Wang Markdown Preview Enhanced Permission Licensing and Access Control Vulnerabilities
Yiyi Wang’s Markdown Preview Enhanced version prior to 0.8.30 contained vulnerabilities related to permission management and access control. These vulnerabilities stemmed from the webview message handler in src/preview-provider.ts, which failed to validate command values and parameters against a...
CVE-2026-108897
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The...
CVE-2026-108897 Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The...
EUVD-2026-97473
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The...
CVE-2026-108897 Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The...
CVE-2026-108897
A security vulnerability exists in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The flaw resides in the syncInvoke function of the WebView JS Bridge component, where manipulation leads to an exposed dangerous routine . This vulnerability can be triggered remotely . While the exploi...
PT-2026-110609
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38 ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The...
CVE-2026-108897: Exposed Dangerous Method or Function
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The...
Smart Media4U SHAREit App: Permission management and access control issues
The Smart Media4U SHAREit App 6.27.38ww version has vulnerabilities related to permission licensing and access control. These vulnerabilities stem from improper handling of the syncInvoke function in the WebView JS Bridge component, allowing dangerous routines to be exposed. Attackers can initiat...
EUVD-2026-90973
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path...
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading th...
CVE-2026-103421
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI path segment after /androidjson/search/' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This make...
CVE-2026-103421 WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI path segment after /androidjson/search/' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This make...
CVE-2026-103421 WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI path segment after /androidjson/search/' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This make...
EUVD-2026-91951
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI path segment after /androidjson/search/' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This make...
PT-2026-104537
Name of the Vulnerable Software and Affected Versions WPMobile.App – Android and iOS App Builder versions prior to 11.85 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages...