2819 matches found
CVE-2025-8113
The Ebook Store WordPress plugin before 5.8015 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
CVE-2025-8046
The Injection Guard WordPress plugin before 1.2.8 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
CVE-2025-8046
The CVE-2025-8046 entry is confirmed with concrete details: Injection Guard WordPress plugin versions prior to 1.2.8 do not escape $_SERVER['REQUEST_URI'] when echoing in an HTML attribute, enabling Reflected XSS in older browsers. Affected software: Injection Guard WordPress plugin
CVE-2025-54800
Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...
The Ultimate Battle: Enterprise Browsers vs. Secure Browser Extensions
Most security tools can't see what happens inside the browser, but that's where the majority of work, and risk, now lives. Security leaders deciding how to close that gap often face a choice: deploy a dedicated Enterprise Browser or add an enterprise-grade control layer to the browsers employees...
GHSA-XCXH-6CV4-Q8P8 HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit
Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target="blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...
PT-2025-34325 · Npm · Hfs
Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target=" blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...
Linux Distros Unpatched Vulnerability : CVE-2021-38496
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash...
Linux Distros Unpatched Vulnerability : CVE-2021-43543
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects...
CVE-2025-4566
CVE-2025-4566 : Elementor Website Builder for WordPress is vulnerable to Stored XSS via the data-text attribute in the Text Path widget (Text Path). Affected: all versions up to 3.30.2. Exploitation requires authenticated access at Contributor level or higher; impact is script execution when a us...
Chromium, Google Chrome, Microsoft Edge. Opera: Multiple Vulnerabilities
Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...
CVE-2025-3467
An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat. When the administrator views the conversation content through the...
CVE-2025-3467
CVE-2025-3467 is a stored/reflected XSS in langgenius/dify before 1.1.3 that specifically affects Firefox. The vulnerability allows an attacker to exfiltrate the administrator’s token by injecting a payload in a published chat; when the admin views the conversation via the monitoring/log function...
PT-2025-28154 · Mozilla +1 · Firefox +1
Name of the Vulnerable Software and Affected Versions: langgenius/dify versions prior to 1.1.3 Description: An XSS vulnerability exists, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat...
CVE-2025-34092
Rejected reason: Neither filed by Chrome nor a valid security vulnerability...
CVE-2025-34092 Chrome Cookie Key Exposure via AppBound COM Path Validation Weakness
A cookie encryption bypass vulnerability exists in Google Chrome’s AppBound mechanism due to weak path validation logic within the elevation service. When Chrome encrypts a cookie key, it records its own executable path as validation metadata. Later, when decrypting, the elevation service compare...
CVE-2025-34092
CVE-2025-34092 describes a cookie encryption bypass in Google Chrome’s AppBound mechanism caused by weak path validation in the elevation service. The vulnerability allows an attacker to impersonate Chrome by naming a binary chrome.exe and placing it on a similar path, enabling retrieval of the e...
CVE-2025-49713
CVE-2025-49713 is a Microsoft Edge (Chromium-based) remote code execution vulnerability through a type confusion in Edge. Affected product: Edge (Chromium-based) browser. Cause: resource access using incompatible type leading to code execution over a network. Impact per CVSS: high severity, user ...
Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Ope...
