CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

8 matches found

Github Security Blog•added 2025/10/20 3:31 p.m.•3 views

Citizen vulnerable to stored XSS in sticky header button messages

Summary The JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages. Details In the copyButtonAttributes function in stickyHeader.js, when copying the button labels, the innerHTML of the new...

6.5CVSS6AI score0.00033EPSS

Exploits0References5Affected Software1

OSV•added 2025/10/17 8:29 p.m.•2 views

CVE-2025-62508 Citizen vulnerable to stored XSS in sticky header button messages

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s...

6.5CVSS6.6AI score0.00033EPSS

Exploits0References5

CNNVD•added 2025/10/17 12:0 a.m.•2 views

Citizen 跨站脚本漏洞

Citizen is a beautiful, easy-to-use and responsive MediaWiki skin from the Star Citizen Wiki team. A cross-site scripting vulnerability exists in Citizen versions 3.3.0 through 3.9.0, which stems from improper handling of the copyButtonAttributes function in stickyHeader.js, which could lead to a...

6.5CVSS5.8AI score0.00033EPSS

Exploits0References4

Snyk•added 2025/07/30 3:23 p.m.•1 views

Malicious Package

Overview @platform-ui-storybook/copy-button is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.8AI score

Exploits0References2