CVE-2025-63883

A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 Bhabishya-123/E-commerce. The site's client-side JavaScript reads attacker-controlled input for example, values derived from the URL or page fragment and inserts it into the DOM via unsafe sinks...

UBUNTU-CVE-2025-62291

In the eap-mschapv2 plugin client-side in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow...

CVE-2025-56800

Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable...

EUVD-2016-10791

Malware in sbrugna...

EUVD-2019-13740

Malware in sbrugna...

EUVD-2019-13878

Malware in sbrugna...

EUVD-2017-5528

Malware in sbrugna...

EUVD-2022-46019

Malicious code in bioql PyPI...

EUVD-2024-30323

Malicious code in bioql PyPI...

EUVD-2025-16464

Malicious code in bioql PyPI...

EUVD-2022-29036

Malicious code in bioql PyPI...

EUVD-2025-25903

Malicious code in bioql PyPI...

EUVD-2024-54411

Malicious code in bioql PyPI...

EUVD-2022-6212

Malicious code in bioql PyPI...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/dialogs process. An attacker can execute arbitrary scripts in the context of a user's browser by submitting...

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.

...

CVE-2025-56694

The cloud-based gallery service lumasoft fotoShare Cloud version 2025-03-13 is vulnerable to a client-side password validation issue (CWE-602). This flaw allows unauthenticated attackers to bypass security measures and view password-protected photo albums . At this time, no newer version containi...

CVE-2016-15046

A client-side remote code execution vulnerability exists in Hanwha Techwin Smart Security Manager SSM versions 1.32 and 1.4, due to improper restrictions on the PUT method exposed by the bundled Apache ActiveMQ instance running on port 8161. An attacker can exploit this flaw through a Cross-Origi...

CVE-2016-15046 Hanwha Techwin SSM 1.32 & 1.4 ActiveMQ File Upload RCE

A client-side remote code execution vulnerability exists in Hanwha Techwin Smart Security Manager SSM versions 1.32 and 1.4, due to improper restrictions on the PUT method exposed by the bundled Apache ActiveMQ instance running on port 8161. An attacker can exploit this flaw through a Cross-Origi...

CVE-2025-34114

CVE-2025-34114 affects OpenBlow whistleblowing platform. The vulnerability is a client-side misconfiguration due to missing critical HTTP response headers: Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy across multiple ...