Cross-site Scripting (XSS)

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dashboard.js view for inspecting detailed run information. An attacker can execute arbitrary JavaScript code in the context of the...

MAL-2025-2561 Malicious code in chatbot-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5af371ce3024a5ed217ff2baf8b2a9443cf92ae8a1993552e3679be6f83698a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-0640

A stored cross-site scripting XSS vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard...

CVE-2024-0640 Stored XSS in chatwoot/chatwoot

A stored cross-site scripting XSS vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard...

WordPress ShareThis Dashboard for Google Analytics plugin authorization issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

CVE-2025-28912

Cross-Site Request Forgery CSRF vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through = 1.0...

CVE-2025-1507

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleactions function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all...

CVE-2025-1507

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleactions function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all...

CVE-2025-1507 ShareThis Dashboard for Google Analytics <= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleactions function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all...

CVE-2025-1507 ShareThis Dashboard for Google Analytics <= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleactions function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all...

WordPress plugin ShareThis Dashboard for Google Analytics 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

WordPress ShareThis Dashboard for Google Analytics plugin <= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation vulnerability

Missing Authorization to Unauthenticated Feature Deactivation vulnerability discovered by m3ssap0 in WordPress Plugin ShareThis Dashboard for Google Analytics versions = 3.2.1...

GHSA-QXP5-GWG8-XV66 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sqs, nats, ollama, slsa-verifier, nfs-subdir-external-provisioner, aactl, openfga, kube-fluentd-operator, helm-operator, aws-s3-controller, skopeo, caddy, certificate-transparency, jitsucom-bulker, terraform-provider-azuread, prometheus, rook,...

WordPress Custom Dashboard Page plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Custom Dashboard Page versions = 1.0...

CVE-2025-28912

Cross-Site Request Forgery CSRF vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through = 1.0...

CVE-2025-28912 WordPress Custom Dashboard Page plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through = 1.0...

CVE-2025-28912

Summary of CVE-2025-28912 (CSRF) — WordPress Custom Dashboard Page plugin Affected product: WordPress Custom Dashboard Page plugin (versions up to 1.0). Issue: Cross-Site Request Forgery (CSRF) vulnerability described in multiple sources (NVD/Red Hat/CVE records). Root cause: CSRF vulnerability a...

WordPress plugin Custom Dashboard Page 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

uberAgent - Splunk dashboard does not display information about applications and desktops from DaaS

Splunk dashboard CVAD/DaaS Applications & Desktops does not display any information about published applications and desktops for DAAS. uberAgent.log file located in C:\Windows\Temp on the machine used for Citrix Cloud monitoring shows the errors: 2025-03-05 12:11:08.145...

CVE-2025-1856

A vulnerability was found in Codezips Gym Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /dashboard/admin/geninvoice.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The...