BUI-select-xss

BUI-select-xss cve-2018-8108 在一次安全测试中，偶然发现给问题 bui是一个前端框架，很多企业都在使用该框架构建自己的前端 通常我们防范xss的方法是会对用户输入统一按照不信任原则，在输出的时候进行转义，传递给前端页面进行展示 但是bui的select组件在展示这部分输出的时候，却将原本已经在转义好的用户输入又给转义了回去，造成xss的payload绕过了原有的安全机制，继续运行 附件中的例子来自于真实的案例 可以看到id为“workGroupList”的input标签中的数据已经做了转义，...

MAL-2026-15529 Malicious code in bui-react-10themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a333445d0f8345bc824161bcc7f6487a59ba9f1f7a852da2643eb7c27dd849b package.json declares a dependency whose key equals this package's own name bui-react-10themes and whose value is a bare HTTPS URL...

Malicious code in bui-react-10themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a333445d0f8345bc824161bcc7f6487a59ba9f1f7a852da2643eb7c27dd849b package.json declares a dependency whose key equals this package's own name bui-react-10themes and whose value is a bare HTTPS URL...

Malicious code in bui-react-10components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd97accb94b52913accc33671fd34134afa96fd92bc09e5d0c440eef9b1a8c6 The package bui-react-10components was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3804 Malicious code in bui-react-10components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd97accb94b52913accc33671fd34134afa96fd92bc09e5d0c440eef9b1a8c6 The package bui-react-10components was found to contain malicious code. Source: ossf-package-analysis...

EUVD-2023-29443

Malicious code in bioql PyPI...

EUVD-2025-30706

Malicious code in bioql PyPI...

CVE-2025-57946

Cross-Site Request Forgery CSRF vulnerability in Loc Bui payOS payos allows Cross Site Request Forgery.This issue affects payOS: from n/a through = 1.0.73...

CVE-2025-57946

Cross-Site Request Forgery CSRF vulnerability in Loc Bui payOS payos allows Cross Site Request Forgery.This issue affects payOS: from n/a through = 1.0.73...

PT-2025-38796

Name of the Vulnerable Software and Affected Versions payOS versions through 1.0.61 Description A Cross-Site Request Forgery CSRF issue exists in Loc Bui payOS. This allows an attacker to perform actions on behalf of a user without their knowledge. The issue affects payOS versions through 1.0.61...

Malicious code in bui-react-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7efb9896b372501d00ef7c23655b29a8eed7ffe274410cb4d2748ec4aa96eda7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3875 Malicious code in bui-react-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7efb9896b372501d00ef7c23655b29a8eed7ffe274410cb4d2748ec4aa96eda7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-25488 WordPress WP Default Feature Image Plugin <= 1.0.1.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Duc Bui Quang WP Default Feature Image plugin = 1.0.1.1 versions...

CVE-2023-25488 WordPress WP Default Feature Image Plugin <= 1.0.1.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Duc Bui Quang WP Default Feature Image plugin = 1.0.1.1 versions...

CVE-2023-25488

CVE-2023-25488 applies to the WordPress plugin WP Default Feature Image . The connected sources describe a Stored Cross-Site Scripting (XSS) vulnerability that affects versions up to and including 1.0.1.1 . The root cause is an input/processing flaw in the plugin’s default feature image handling ...

PT-2023-20106 · WordPress · Duc Bui Quang Wp Default Feature Image

Name of the Vulnerable Software and Affected Versions: Duc Bui Quang WP Default Feature Image plugin versions 1.0.1.1 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects th...

MAL-2023-280 Malicious code in dow-load-the-best-we-could-do-by-thi-bui-on-ipad-new-format- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbe34371c86eb25d33028fc43131c1b1b281f7e57986816c88163b17125302b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tinkoff-react-bui/input (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f3abba81dd7afefb444eaea1ecbf7340da688924bfac3688c7eb968144bb090 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-655 Malicious code in @tinkoff-react-bui/input (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f3abba81dd7afefb444eaea1ecbf7340da688924bfac3688c7eb968144bb090 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-647 Malicious code in @tinkoff-react-bui/animation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8a585bbe295ae8c576090635a2562eb4ca85c55846e2fe6f9b499117dda47cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...