Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Summary Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site. Details Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject in their site and run the script. By using...

GHSA-4GF7-FF8X-HQ99 Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Summary Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site. Details Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject in their site and run the script. By using...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @bloggrify/bento (>=0.9.1, <=1.0.0) +27 more potentially affected by CVE-2025-24360 via @nuxt/vite-builder (>=3.8.1, <=3.15.2)

@nuxt/vite-builder NPM version =3.8.1, =1.0.1, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.0.1-alpha.1024, =3.2.0, =0.2.3, =0.2.0-alpha.2, =0.2.0 - @xizs/nuxt-base 0.0.2 and more Source cves: CVE-2025-24360 Source advisory: OSV:GHSA-2452-6XJ8-JH47...

PT-2025-1943 · National Instruments · Ni Vision Builder Ai +1

Name of the Vulnerable Software and Affected Versions: NI Vision Builder AI affected versions not specified NI Vision Development Module affected versions not specified Description: The issue is related to the use of a third-party library for image processing in NI's vision software, which expose...

CVE-2025-24360 Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite...

CVE-2025-24755

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Stored XSS.This issue affects PDF Invoice Builder for WooCommerce: from n/a through = 4.6.0...

CVE-2025-24722

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Stored XSS.This issue affects FAQ Builder AYS: from n/a through = 1.7.3...

CVE-2025-24713

Cross-Site Request Forgery CSRF vulnerability in Wow-Company Button Generator – easily Button Builder button-generation allows Cross Site Request Forgery.This issue affects Button Generator – easily Button Builder: from n/a through = 3.1.1...

CVE-2025-24672

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form Builder CP: from n/a through = 1.2.41...

CVE-2025-24722 WordPress FAQ Builder AYS Plugin <= 1.7.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in F.A.Q Builder Team FAQ Builder AYS allows Stored XSS. This issue affects FAQ Builder AYS: from n/a through 1.7.3...

CVE-2025-24722 WordPress FAQ Builder AYS Plugin <= 1.7.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Stored XSS.This issue affects FAQ Builder AYS: from n/a through = 1.7.3...

CVE-2025-24722

CVE-2025-24722 is a Stored XSS in the WordPress plugin FAQ Builder AYS (WordPress FAQ Builder AYS) affecting versions from 0? through 1.7.3 as reported. The root cause is described as improper neutralization of input during web page generation, enabling injection of malicious scripts. Several sou...

CVE-2025-24713

CVE-2025-24713 is a CSRF vulnerability in the WordPress plugin “Button Generator – easily Button Builder” (Wow-Company Button Generator). Public details indicate the issue affects versions up to 3.1.1 (vulnerability range: n/a through 3.1.1) and is classified as Cross-Site Request Forgery. The CV...

CVE-2025-24672 WordPress Form Builder CP Plugin <= 1.2.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CodePeople Form Builder CP allows SQL Injection. This issue affects Form Builder CP: from n/a through 1.2.41...

CVE-2025-24672 WordPress Form Builder CP Plugin <= 1.2.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form Builder CP: from n/a through = 1.2.41...

CVE-2025-24672

CVE-2025-24672: SQL Injection in WordPress Form Builder CP plugin (Form Builder CP) affecting versions n/a through 1.2.41. The vulnerability originates from improper neutralization of input in SQL commands, enabling injection. CVSSv3.1 base score 8.5 (High) with network attack vector, low attack ...

WordPress PDF Invoice Builder for WooCommerce plugin <= 4.6.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin PDF Invoice Builder for WooCommerce versions = 4.6.0...

WordPress FAQ Builder AYS Plugin <= 1.7.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Logan Cote in WordPress Plugin FAQ Builder AYS versions = 1.7.3...

WordPress Form Builder CP Plugin <= 1.2.41 - SQL Injection vulnerability

SQL Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Form Builder CP versions = 1.2.41...

WordPress Button Generator – easily Button Builder Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Khang Duong in WordPress Plugin Button Generator – easily Button Builder versions = 3.1.1...