Recent NPM package hack is an alarming reminder of the risks of website supply-chain fraud

There are over 1.8 billion websites online today. Almost 98% of them are powered by JavaScript, and for a good reason: JavaScript’s flexibility and portability enable the rich online functionality we’ve all come to know and love. But when that same functionality becomes a significant vector for...

Folder Lock Cross-Site Scripting Vulnerability

Folder Lock is a perfect data security application from NewSoftwares, Inc. Folder Lock is vulnerable to a cross-site scripting vulnerability in v3.4.5, which stems from the " Create Folder" function under the "Create" module lacks a data validation filter for user-supplied data and output. An...

MyBB Cross-Site Scripting Vulnerability (CNVD-2021-103573)

MyBB is a free and web-based forum software developed by MyBB team using PHP and MySQL. MyBB has a cross-site scripting vulnerability in versions prior to 1.8.28, which stems from the lack of proper validation of client-side data in the template name displayed in the theme management of the WEB...

Akaunting Cross-Site Scripting Vulnerability (CNVD-2021-103569)

Akaunting, an application from Akaunting, Inc. provides all the tools needed to manage funds online.Akaunting version 1.3.17 contains a cross-site scripting vulnerability that stems from a lack of checksum filtering of user-supplied and output data in the company name input field. An attacker cou...

WordPress Special Text Boxes plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress Special Text Boxes plugin in versions prior to 5.9.109 suffers from a cross-site scripting vulnerabili...

Shopware Cross-Site Scripting Vulnerability (CNVD-2021-103572)

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware in versions prior to 5.7.6 suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit the...

Froala WYSIWYG Editor 跨站脚本漏洞

Froala WYSIWYG Editor is a software application. A beautiful JavaScript web editor that is easy for developers to integrate and your users will love its clean design. Froala WYSIWYG Editor suffers from a cross-site scripting vulnerability that stems from a lack of proper validation of client-side...

Shopware 跨站脚本漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware in versions prior to 5.7.6 suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit the...

Tibco Software TIBCO Nimbus 跨站脚本漏洞

Tibco Software TIBCO Nimbus is a business application for process documentation from Tibco Software, USA. A cross-site scripting vulnerability exists in TIBCO Nimbus, which stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerabilit...

Pi-hole 跨站脚本漏洞

Pi-hole is a web-grade ad-blocking application from Pi-hole, Inc. Pi-hole suffers from a cross-site scripting vulnerability that stems from the WEB application's lack of proper validation of client-side data. An attacker can exploit this vulnerability to execute client-side code...

Alfresco Cross-Site Scripting Vulnerability (CNVD-2021-83570)

Alfresco is an open source enterprise content management system. The platform page using Freemarker development , the main features include document management , collaboration , records management , knowledge base management , Web content management and so on. Alfresco has a security vulnerabilit...

WordPress 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress YouTube plugin before version 1.4 has a cross-site scripting vulnerability that stems from a lack of checksum filtering ...

WordPress Html5 Audio Player plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Html5 Audio Player plugin in versions...

WordPress Easy Download Manager and File Sharing plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.The WordPress Easy Download Manager and File Sharing plugin has a cross-site scripting vulnerability in versions prior ...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-103642)

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress One User Avatar plugin in versions prior to 2.3.7 has a cross-site scripting vulnerability that stems from a lack...

WordPress GamePress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-103639)

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress GamePress plugin in version 1.1.0 and earlier has a cross-site scripting vulnerability, which stems from...

WordPress Tutor LMS plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. WordPress Tutor LMS plugin in versions prior to 1.9.9 has a cross-site scripting vulnerability, which stems from the plugin's...

Snipe-IT Cross-Site Scripting Vulnerability (CNVD-2022-19845)

Snipe-IT is an open source IT asset/license management system. snipe-IT has a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in the WEB application, which can be exploited by attackers to execute client-side code...

Perfex Crm 跨站脚本漏洞

Perfex Crm is a customer relationship management software. For managing clients, projects and creating invoices in the cloud. There is a security vulnerability in Perfex CRM that originates from the client side client via the company name parameter. No details of the vulnerability are provided at...

IBM QRadar Advisor with Watson Cross-Site Scripting Vulnerability

IBM QRadar Advisor with Watson is a suite of security threat analysis solutions from IBM USA. The product includes features such as security threat response and threat probing. A security vulnerability exists in IBM QRadar Advisor with Watson, which stems from the lack of proper validation of...