448 matches found
CVE-2025-11844
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...
CVE-2025-11844 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...
CVE-2025-11844
Hugging Face Smolagents 1.20.0 has an XPath injection in search_item_ctrl_f (vision_web_browser.py) where user input is concatenated into XPath queries without sanitization, allowing attackers to modify query logic, bypass filters, and access unintended DOM elements, potentially disrupting AI web...
CVE-2025-11844 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...
Hugging Face Transformers 安全漏洞
Hugging Face Transformers is Hugging Face's open source advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers version 1.20.0, which stems from the searchitemctrlf function splicing user input directly into XPath...
CVE-2025-11844: Improper Neutralization of Data within XPath Expressions
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...
CVE-2025-7473: XML Injection (aka Blind XPath Injection)
Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection...
CVE-2025-60833: XML Injection (aka Blind XPath Injection)
An XML External Entity XXE vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data...
EUVD-2012-4762
Malware in sbrugna...
EUVD-2015-5913
Malware in sbrugna...
EUVD-2012-4765
Malware in sbrugna...
EUVD-2016-9966
Malware in sbrugna...
EUVD-2020-17853
Malware in sbrugna...
EUVD-2019-1143
Malware in sbrugna...
EUVD-2013-0516
Malware in sbrugna...
EUVD-2022-27391
Malicious code in bioql PyPI...
EUVD-2022-4058
Malicious code in bioql PyPI...
EUVD-2022-27390
Malicious code in bioql PyPI...