CVE-2025-10949 Changsha Developer Technology iView Editor Markdown cross site scripting

A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. T...

CVE-2025-10949 Changsha Developer Technology iView Editor Markdown cross site scripting

A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. T...

CVE-2025-59832: Improper Neutralization of Input During Web Page Generation

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, an...

iView Editor Code Injection Vulnerability

iView Editor is an editor for iView open source. A code injection vulnerability exists in iView Editor 1.1.1 and earlier versions, which stems from improper handling of the component Markdown Handler, and could lead to cross-site scripting attacks...

CVE-2025-10949: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. T...

PT-2025-39392

Name of the Vulnerable Software and Affected Versions Changsha Developer Technology iView Editor versions up to 1.1.1 Description A flaw exists in the Markdown Handler component of the software that allows for cross site scripting. The issue is remotely exploitable and details of the exploit are...

Horilla security vulnerabilities

Horilla is a free and open source human resources software from Horilla Inc. A security vulnerability exists in Horilla versions prior to 1.4.0, which stems from the presence of stored cross-site scripting in the ticket comment editor that could cause a low-privileged user to execute arbitrary...

Adobe Dreamweaver HTML Editor Cross-site Request Manipulation

The vulnerability of Adobe Dreamweaver HTML editor is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a hacker to execute arbitrary code by sending a specially created malicious link...

graphos-cli (>=1.0.0, <=1.0.1), panshi-client (>=0.0.7, <=0.0.8) potentially affected by CVE-2025-57320 via json-schema-editor-visual (>=1.1.1, <=2.0.0)

json-schema-editor-visual NPM version =1.1.1, =1.0.0, =0.0.7, =0.0.8 Source cves: CVE-2025-57320 Source advisory: SNYK:JS-JSONSCHEMAEDITORVISUAL-13110010...

graphos-cli (>=1.0.0, <=1.0.1) potentially affected by CVE-2025-57320 via json-schema-editor-visual (2.0.0)

json-schema-editor-visual NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on json-schema-editor-visual and may be impacted: - graphos-cli =1.0.0, =1.0.1 Source cves: CVE-2025-57320 Source advisory: OSV:GHSA-3C3P-XH4F-PFH7...

GHSA-3C3P-XH4F-PFH7 json-schema-editor-visual vulnerable to prototype pollution

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload,...

Prototype Pollution

Overview json-schema-editor-visual is a jsonschema editor Affected versions of this package are vulnerable to Prototype Pollution via the setData or deleteData functions. An attacker can manipulate the prototype of objects by supplying a crafted payload, potentially leading to unauthorized...

json-schema-editor-visual vulnerable to prototype pollution

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload,...

graphos-cli (>=1.0.0, <=1.0.1) potentially affected by CVE-2025-57320 via json-schema-editor-visual (2.0.0)

json-schema-editor-visual NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on json-schema-editor-visual and may be impacted: - graphos-cli =1.0.0, =1.0.1 Source cves: CVE-2025-57320 Source advisory: GHSA-3C3P-XH4F-PFH7...

CVE-2025-57320

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload,...

CVE-2025-57320

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload,...

CVE-2025-58232

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ickata Image Editor by Pixo image-editor-by-pixo allows DOM-Based XSS.This issue affects Image Editor by Pixo: from n/a through = 2.3.8...

CVE-2025-57909

Missing Authorization vulnerability in Rouergue Création Editor Custom Color Palette editor-custom-color-palette allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editor Custom Color Palette: from n/a through = 3.5.6...

DRUPAL-CONTRIB-2025-107

This module integrates Plausible Analytics on a site. The module did not properly filter output in certain cases. This vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment...

CVE-2025-57320: Improperly Controlled Modification of Object Prototype Attributes

json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers to inject or delete properties on Object.prototype via supplying a crafted payload,...