6363 matches found
CVE-2025-63883
A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 Bhabishya-123/E-commerce. The site's client-side JavaScript reads attacker-controlled input for example, values derived from the URL or page fragment and inserts it into the DOM via unsafe sinks...
PT-2025-47327
Name of the Vulnerable Software and Affected Versions electic-shop version 1.0 Description A DOM-based cross-site scripting issue exists where the client-side JavaScript reads attacker-controlled input and inserts it into the DOM via unsafe sinks, specifically innerHTML, insertAdjacentHTML, and...
CVE-2025-56527
The RAG-based tool Kotaemon version 0.11.0 (including commit 37cdc28 ) is vulnerable to plaintext credential storage in the client's localStorage. Specifically, libs/ktem/ktem/pages/login.py and libs/ktem/ktem/assets/js/main.js store raw usernames and passwords, which can be accessed by any scrip...
Windu CMS 安全漏洞
Windu CMS Windu CMS is a lightweight web content management system CMS from Windu. A security vulnerability exists in Windu CMS version 4.1, which stems from insufficient client-side brute force protection and could lead to brute force attacks...
CLSA-2025-1763374645 varnish: Fix of 2 CVEs
CVE-2024-30156: fix HTTP/2 flow control vulnerability allowing window credit exhaustion Broke Window Attack causing potential denial of service - CVE-2025-47905: fix client-side request smuggling via malformed HTTP/1 chunked requests...
CVE-2025-64308
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle...
CVE-2025-64308
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal...
Brightpick Mission Control 安全漏洞
Brightpick Mission Control is a centralized control platform for mission management from Brightpick USA. A security vulnerability exists in Brightpick Mission Control that stems from the inclusion of hard-coded credentials in a client-side JavaScript package...
CVE-2025-64308 Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal...
EUVD-2025-197665
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle...
CVE-2025-64308 Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal...
CVE-2025-64308
Brightpick Mission Control web application exposes hardcoded credentials in the client-side JavaScript bundle. The vulnerability can enable unauthorized access to credentials and could allow manipulation of robot control functions through an unauthenticated interface and via WebSocket traffic, pe...
CVE-2025-64308: Unprotected Transport of Credentials
The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal...
The vulnerability of the CSC (Client-Side Caching) service in Windows operating systems allows attackers to enhance their privileges.
The vulnerability of the CSC Client-Side Caching service in Windows operating systems is related to access control errors. Exploiting this vulnerability can allow attackers to enhance their privileges...
CVE-2025-12872
The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing malicious JavaScript code, which will execute on the client side when a user is tricked into visiting a specific URL...
CVE-2025-60705
Improper access control in Windows Client-Side Caching CSC Service allows an authorized attacker to elevate privileges locally...
CVE-2025-10161
Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass.This iss...
CVE-2025-12872
The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing malicious JavaScript code, which will execute on the client side when a user is tricked into visiting a specific URL...