2796 matches found
CVE-2024-13993
Nagios XI versions prior to 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) attack on the login page when accessed with older browsers. The root cause is insufficient validation/escaping of user-supplied input reflected by the login page, enabling a crafted link to execute arb...
CVE-2024-13993 Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers
Nagios XI versions prior to 2024R1.1.2 are vulnerable to a reflected cross-site scripting XSS via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when...
PT-2025-44496
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.2 Description The software is susceptible to a reflected cross-site scripting XSS issue via the login page when accessed using older web browsers. Insufficient validation or escaping of user-supplied input...
Account Takeover
color is vulnerable to Account Takeover. The vulnerability is due to a phishing-based takeover of the npm publishing account, which allowed an attacker to inject malware that attempted to redirect cryptocurrency transactions in browser environments...
EUVD-2025-36194
IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
Cross-site Scripting
dotnetnuke.core is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper encoding of user input in URL and template rendering, allowing attackers to inject malicious scripts that execute in victims’ browsers...
Adobe Connects Cross-Site Scripting Vulnerability (CNVD-2025-24428)
Adobe Connect is a software for creating meeting environments from the American company Audobee Adobe. Adobe Connect suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute malicious script in a victim's browser...
The present and potential future of progressive image rendering
Progressive image formats allow the decoder to create a partial rendering when only part of the image resource is available. Sometimes it's part of the image, and sometimes it's a low quality/resolution version of the image. I've been digging into it recently, and I think there are some common...
In-Browser LLM-Guided Fuzzing for Real-Time Prompt Injection Testing in Agentic AI Browsers
Large Language Model LLM based agents integrated into web browsers often called agentic AI browsers offer powerful automation of web tasks. However, they are vulnerable to indirect prompt injection attacks, where malicious instructions hidden in a webpage deceive the agent into unwanted actions...
CVE-2025-11712
A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. This vulnerabilit...
CVE-2025-11712 An OBJECT tag type attribute overrode browser behavior on web resources without a content-type
A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. This vulnerabilit...
Adobe Connect 跨站脚本漏洞
Adobe Connect is a software for creating meeting environments from the American company Audobee Adobe. Adobe Connect suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute malicious script in a victim's browser...
SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution
Palo Alto, California, 9th October 2025, CyberNewsWire...
New Shuyal Stealer Targets 17 Web Browsers for Login Data and Discord Tokens
Researchers warn of Shuyal Stealer, malware that gathers browser logins, system details, and Discord tokens, then erases evidence via Telegram...
EUVD-2021-10007
Malware in sbrugna...
EUVD-2019-1633
Malware in sbrugna...
EUVD-2017-15003
Malware in sbrugna...
EUVD-2019-0436
Malware in sbrugna...