Cross-site Scripting (XSS)

Overview bootstrap-table is an extended table to integration with some of the most widely used CSS frameworks. Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation, Vue.js. Affected versions of this package are vulnerable to Cross-site Scripting XSS. A type confusion vulnerability...

CVE-2021-23443

This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array instead of a string or a SafeValue, even if are used...

CVE-2021-23443: Access of Resource Using Incompatible Type

This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array instead of a string or a SafeValue, even if are used...

Cross-site Scripting (XSS)

Overview teddy is a The most readable and easy to learn templating language there is! Affected versions of this package are vulnerable to Cross-site Scripting XSS. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array instead of a string. PoC...

mpath module 安全漏洞

The mpath module is a module for getting/setting the value of a javascript object using a path representation similar to MongoDB. A security vulnerability exists in mpath module before 0.8.4, which stems from type confusion, where if the input is an array, the method called is...

object-path 安全漏洞

object-path is a personal developer's Npm library for accessing variables in data structures via paths. object-path versions prior to 0.11.6 have a security vulnerability that results from a type obfuscation vulnerability when the path component used in the path parameter is an array. No details ...

PT-2021-6499

Name of the Vulnerable Software and Affected Versions datatables.net versions prior to 1.11.3 Description The issue is related to the incorrect handling of an array in the input data by the DataTables plugin, which can allow a remote attacker to compromise data integrity. If an array is passed to...

PT-2021-4173 · Sunhillo · Sunhillo Sureline

Content removed...

CVE-2021-32696

The npm package "striptags" is an implementation of PHP's striptags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause striptags to concatenate unsanitized strings when an array-like object is passed in as the html parameter. This can be abused by an attack...

Design/Logic Flaw

This affects all versions of package iniparserjs. This vulnerability relates when iniparser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program...

DEBIAN-CVE-2021-21263

Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an...

CVE-2021-21263

Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is crafted where a field that is normally a non-array value is an...

Unexpected bindings in QueryBuilder

This is a follow-up to the previous security advisory GHSA-3p32-j457-pg5x which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the quer...

Sql injection

The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne or findAll call, unless a developer recognizes an undocumented need to sanitize array input...

CVE-2018-7269

The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne or findAll call, unless a developer recognizes an undocumented need to sanitize array input...

Laravel 5.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Laravel non-presistent XSS in validation of arrays Date: 06/03/2017 Exploit Author: MaHDyfo mahdyfofthe at signgmail.com Vendor Homepage: laravel.com Version: 5.4 In Laravel validation rules, assume that you set a rule to get an...

Boonex Dolphin 7.3.2 - Authentication Bypass

Exploit Title : Boonex Dolphin all versoin array This will allow the attacker to bypass the authentication and can also enter in admin panel. Independent Pakistani Security Researcher...