Malicious code in cressida-darkmatter-bootstrap-luna (npm)

The package cressida-darkmatter-bootstrap-luna was found to contain malicious code...

MAL-2025-45760 Malicious code in react-bootstrap-helmet-archaeometry-server (npm)

The package react-bootstrap-helmet-archaeometry-server was found to contain malicious code...

MAL-2025-43615 Malicious code in betelgeuse-react-bootstrap-toml-wolf (npm)

The package betelgeuse-react-bootstrap-toml-wolf was found to contain malicious code...

Malicious code in react-bootstrap-telesto-jupiter-transform (npm)

The package react-bootstrap-telesto-jupiter-transform was found to contain malicious code...

Malicious code in stratigraphy-bootstrap-lithosphere-bellatrix (npm)

The package stratigraphy-bootstrap-lithosphere-bellatrix was found to contain malicious code...

MAL-2025-45574 Malicious code in polaris-io-react-bootstrap-polaris (npm)

The package polaris-io-react-bootstrap-polaris was found to contain malicious code...

Malicious code in subscription-bootstrap-publish-semantic-release (npm)

The package subscription-bootstrap-publish-semantic-release was found to contain malicious code...

Malicious code in react-bootstrap-fornax-deimos-prettier-plugin-markdown (npm)

The package react-bootstrap-fornax-deimos-prettier-plugin-markdown was found to contain malicious code...

CVE-2023-7008 affecting package systemd-bootstrap for versions less than 250.3-18

CVE-2023-7008 affecting package systemd-bootstrap for versions less than 250.3-18. A patched version of the package is available...

CVE-2025-41051

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/bootstrap...

CVE-2025-41051

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/bootstrap...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/bootstrap process. An attacker can execute arbitrary JavaScript code in the context of a user's browser by...

CVE-2025-41051 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/bootstrap...

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

...

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attributeIn Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute

...

CVE-2025-41051: Improper Neutralization of Input During Web Page Generation

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/bootstrap...

PT-2025-35922

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: A stored authenticated cross-site scripting XSS issue exists due to insufficient validation of user-supplied data. The vulnerability is triggered through the dataAddonlayouts and dataAddonlayouts except...

appRain CMF Cross-Site Script Vulnerability

appRain CMF is a content management framework. A cross-site scripting vulnerability exists in appRain CMF due to improper validation of user input on the /apprain/developer/addons/update/bootstrap endpoint. An attacker could use this vulnerability to steal the victim's cookie-based authentication...

Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.

...

WordPress Plugin All Bootstrap Blocks Access Control Break Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control disruption vulnerability exists in the WordPress plugin All Bootstrap Blocks, which...