25 matches found
EUVD-2022-1825
Malicious code in bioql PyPI...
EUVD-2025-27413
Malicious code in bioql PyPI...
CVE-2025-57665
Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
@142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.24), @56jun/fe-chat (>=1.0.0-beta.1, <=1.0.0-beta.26) +599 more potentially affected by CVE-2025-57665 via element-plus (>=2.0.0, <=2.10.7)
element-plus NPM version =2.0.0, =0.0.1-alpha.14, =1.0.0-beta.1, =0.6.1-annotator.1, =1.1.2, =2.4.2-beta.1, =1.1.2, =0.7.0-annotator.0, =1.0.3, =1.4.2, =1.0.1, =3.72.0, =2.0.6, =0.0.0, =0.0.11 and more Source cves: CVE-2025-57665 Source advisory: OSV:GHSA-5M5X-9J46-H678...
Improper Encoding or Escaping of Output
Overview element-plus is an A Component Library for Vue 3 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious sites, or conduct...
Improper Encoding or Escaping of Output
Overview org.webjars.npm:element-plus is an A Component Library for Vue 3 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious...
Element Plus Link component (el-link) implements insufficient input validation for the href attribute
Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
GHSA-5M5X-9J46-H678 Element Plus Link component (el-link) implements insufficient input validation for the href attribute
Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
CVE-2025-57665
Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
CVE-2025-57665
Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
CVE-2025-57665
Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
PT-2025-36908
Name of the Vulnerable Software and Affected Versions: Element Plus versions through 2.10.6 Description: The Element Plus Link component el-link does not sufficiently validate input for the href attribute, creating a security gap. This allows attackers to inject malicious URLs using dangerous...
CVE-2025-57665
CVE-2025-57665 affects Element Plus Link component (el-link) up to version 2.10.6. The root cause is insufficient input validation of the href attribute, with user-controlled href values passed directly to underlying anchor elements without protocol validation, URL sanitization, or security heade...
CVE-2025-57665
Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...
Element Plus 安全漏洞
Element Plus is an open source Vue.js 3 UI library from the China Element Plus organization. A security vulnerability exists in Element Plus 2.10.6 and earlier versions, which stems from insufficient input validation of the href attribute and could lead to cross-site scripting attacks and phishin...
CVE-2022-27103
element-plus 2.0.5 is vulnerable to Cross Site Scripting XSS via el-table-column...
@advanced-elements/table (>=2.0.6, <=2.0.10), @ahcui/vue3-multiplex (1.0.0-rc2) +20 more potentially affected by CVE-2022-27103 via element-plus (>=2.0.0, <=2.0.5)
element-plus NPM version =2.0.0, =2.0.6, =1.0.0-beta.1, =0.1.2, =0.1.7, =1.0.1, =1.1.8, =2.7.24, =0.5.14, =1.0.2, =0.1.61, =1.1.2, =1.0.0, =1.0.1 and more Source cves: CVE-2022-27103 Source advisory: OSV:GHSA-RJVG-8V36-XV9R...
element-plus vulnerable to cross-site scripting (XSS) via el-table-column
element-plus below 2.0.5 is vulnerable to Cross Site Scripting XSS when attribute show-tooltips-overflow of el-table-column is true. The mouseover action will make the text of this column render as html...
GHSA-RJVG-8V36-XV9R element-plus vulnerable to cross-site scripting (XSS) via el-table-column
element-plus below 2.0.5 is vulnerable to Cross Site Scripting XSS when attribute show-tooltips-overflow of el-table-column is true. The mouseover action will make the text of this column render as html...