Malicious code in dropdown-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2d336f300d1cbb10697762ccb19e2efa75d88c7a9f180ca4e472b6861b6d5ca0 The OpenSSF Package Analysis project identified 'dropdown-input' @ 3.4.15 npm as malicious. It is considered malicious because: - The package...

CVE-2023-5110

The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Plugin BSK PDF Manager Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. WordPress Plugin BSK PDF Manager...

CVE-2023-41163

A Reflected Cross-site scripting XSS vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools drop down...

PT-2023-27839 · Usermin · Usermin

Name of the Vulnerable Software and Affected Versions: Usermin version 2.000 Description: A Reflected Cross-site scripting XSS issue in the file manager tab allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools...

Cross Site Scripting (XSS)

svelecte is vulnerable to Cross Site Scripting XSS. The vulnerability occurs when a user enters a specially crafted item name in the Svelte dropdown. Sites using Svelecte with dynamically created items from external or user-created content may be vulnerable to XSS attacks and clickjacking...

Svelecte Cross-Site Scripting Vulnerability

Svelecte is a flexible autocomplete/select component written in Svelte. A cross-site scripting vulnerability exists in Svelecte 3.16.2 and earlier versions, which stems from the presence of a cross-site scripting XSS vulnerability. An attacker can exploit this vulnerability to inject arbitrary HT...

CVE-2023-30963 Stored XSS in Foundry Slate Query Dropdown menu

A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry instances. No further...

CVE-2023-30963 Stored XSS in Foundry Slate Query Dropdown menu

A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry instances. No further...

Chamilo 跨站脚本漏洞

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo versions prior to 1.11.20 that...

TinyMCE Custom Styles < 1.1.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to "Settings" » "TinyMCE Custom Styles"...

CVE-2023-2557

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level...

Malicious code in fc-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a99503aba932a84132975cce8dc2b3070cc1df0b8a2d0843ff7c338bad3977c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-343 Malicious code in fc-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a99503aba932a84132975cce8dc2b3070cc1df0b8a2d0843ff7c338bad3977c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-Q82H-Q47J-F492 Cross-site Scripting in jspreadsheet

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting XSS...

Cross-site Scripting in jspreadsheet

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting XSS...

CVE-2022-48115

CVE-2022-48115 affects jspreadsheet CE prior to 4.6.0, with a cross-site scripting (XSS) vulnerability in the dropdown/menu code path. Root cause identified as insufficient sanitization/handling in the dropdown implementation, enabling attacker-controlled input to execute scripts in a victim’s br...

CVE-2022-48115

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting XSS...

SUSE CVE-2011-0687

Opera before 11.01 does not properly implement Wireless Application Protocol WAP dropdown lists, which allows user-assisted remote attackers to cause a denial of service application crash via a crafted WAP document...

SUSE CVE-2013-5593

The SELECT element implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly restrict the nature or placement of HTML within a dropdown menu, which allows remote attackers to spoof the address bar or conduct...