CVE-2026-41518

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In versions 4.9.0 through 5.0.0, an authenticated user with project-editor permissions can store arbitrary HTML/JavaScript in the ChartDatasetConfig.legend field. The...

EUVD-2025-199325

Malicious code in @commute/market-data-chartjs npm...

MAL-2025-191209 Malicious code in @commute/market-data-chartjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e906d8b501e2641730640922fb6196f422637e4fa3c7eb6e5823dc3f6301026c The package @commute/market-data-chartjs was found to contain malicious code. Source: ghsa-malware...

Malware in @commute/market-data-chartjs

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-6082

The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-6081

The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-6082

The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-6081

The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-6081

CVE-2023-6081 affects the WordPress Chart.js plugin “enigma-chartjs” up to version 2023.2. The vulnerability arises from insufficient sanitization/escaping of certain settings, potentially enabling Stored Cross-Site Scripting by high-privilege users (e.g., Editor) even when unfiltered_html is dis...

CVE-2023-6081: Improper Neutralization of Input During Web Page Generation

The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2024-14877 · WordPress · Chartjs

Name of the Vulnerable Software and Affected Versions: chartjs WordPress plugin versions through 2023.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

PT-2024-14878 · WordPress · Chartjs

Name of the Vulnerable Software and Affected Versions: chartjs WordPress plugin versions through 2023.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

CVE-2023-6082: Improper Neutralization of Input During Web Page Generation

The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Malware in chartjs-2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-173 Malicious code in chartjs-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0694218023b99a066388095e0c9d8de4e8d09473cc88abac25165435e4a5d7d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chartjs-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0694218023b99a066388095e0c9d8de4e8d09473cc88abac25165435e4a5d7d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in angara.chartjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fa5dd768fc2f40637bc958f4d7e2d906c38a191086e3c753d24760ec70faad9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

at.molindo:molindo-wicket-utils (3.0.0), com.cooldatasoft:wicket-menu (>=6.14.0.0, <=6.14.0.4) +233 more potentially affected by CVE-2021-23937 via org.apache.wicket:wicket-core (6.14.0)

org.apache.wicket:wicket-core MAVEN version 6.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - at.molindo:molindo-wicket-utils 3.0.0 - com.cooldatasoft:wicket-menu =6.14.0.0, =6.14.0.0, =6.14.0,...

at.molindo:molindo-wicket-utils (3.0.0), com.cooldatasoft:wicket-menu (>=6.14.0.0, <=6.14.0.4) +233 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (6.14.0)

org.apache.wicket:wicket-core MAVEN version 6.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - at.molindo:molindo-wicket-utils 3.0.0 - com.cooldatasoft:wicket-menu =6.14.0.0, =6.14.0.0, =6.14.0,...