EUVD-2025-27413

Malicious code in bioql PyPI...

EUVD-2022-1825

Malicious code in bioql PyPI...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

1997ckf-ui-comp (>=0.0.9, <=0.0.17), 1data-business (>=0.0.1, <=0.0.3) +6163 more potentially affected by CVE-2025-57665 via element-plus (>=1.0.1-beta.0, <=2.14.4)

element-plus NPM version =1.0.1-beta.0, =0.0.9, =0.0.1, =1.0.0, =0.1.11, =0.1.0, =1.0.0, =0.3.1, =1.0.0-beta.0, =1.0.0, =0.0.1-alpha.10, =0.1.6-alpha.17, =0.1.6-alpha.18 - @17mkh/ui 0.0.2 - @1api/serve 0.1.0 and more Source cves: CVE-2025-57665 Source advisory: SNYK:JS-ELEMENTPLUS-12670415...

@12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.7), @142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.24) +583 more potentially affected by CVE-2025-57665 via element-plus (>=2.0.0, <=2.10.7)

element-plus NPM version =2.0.0, =1.0.0-beta.0, =0.0.1-alpha.14, =1.0.0-beta.1, =0.6.1-annotator.1, =1.1.2, =2.0.0, =0.0.0-beta.7, =0.7.0-annotator.0, =1.0.3, =1.0.0, =1.0.0, =0.1.0-beta.0, =3.72.0, =3.362.6 - @acegroup/cli-templates-vue3-element-admin 1.0.0 - @advanced-elements/form 1.0.0 and mo...

Improper Encoding or Escaping of Output

Overview element-plus is an A Component Library for Vue 3 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious sites, or conduct...

GHSA-5M5X-9J46-H678 Element Plus Link component (el-link) implements insufficient input validation for the href attribute

Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:element-plus is an A Component Library for Vue 3 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious...

Element Plus Link component (el-link) implements insufficient input validation for the href attribute

Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

CVE-2025-57665 affects Element Plus Link component (el-link) up to version 2.10.6. The root cause is insufficient input validation of the href attribute, with user-controlled href values passed directly to underlying anchor elements without protocol validation, URL sanitization, or security heade...

PT-2025-36908

Name of the Vulnerable Software and Affected Versions: Element Plus versions through 2.10.6 Description: The Element Plus Link component el-link does not sufficiently validate input for the href attribute, creating a security gap. This allows attackers to inject malicious URLs using dangerous...

Element Plus 安全漏洞

Element Plus is an open source Vue.js 3 UI library from the China Element Plus organization. A security vulnerability exists in Element Plus 2.10.6 and earlier versions, which stems from insufficient input validation of the href attribute and could lead to cross-site scripting attacks and phishin...

CVE-2022-27103

element-plus 2.0.5 is vulnerable to Cross Site Scripting XSS via el-table-column...

@advanced-elements/table (>=2.0.6, <=2.0.10), @ahcui/vue3-multiplex (1.0.0-rc2) +20 more potentially affected by CVE-2022-27103 via element-plus (>=2.0.0, <=2.0.5)

element-plus NPM version =2.0.0, =2.0.6, =1.0.0-beta.1, =0.1.2, =0.1.7, =1.0.1, =1.1.8, =2.7.24, =0.5.14, =1.0.2, =0.1.61, =1.1.2, =1.0.0, =1.0.1 and more Source cves: CVE-2022-27103 Source advisory: OSV:GHSA-RJVG-8V36-XV9R...

element-plus vulnerable to cross-site scripting (XSS) via el-table-column

element-plus below 2.0.5 is vulnerable to Cross Site Scripting XSS when attribute show-tooltips-overflow of el-table-column is true. The mouseover action will make the text of this column render as html...

GHSA-RJVG-8V36-XV9R element-plus vulnerable to cross-site scripting (XSS) via el-table-column

element-plus below 2.0.5 is vulnerable to Cross Site Scripting XSS when attribute show-tooltips-overflow of el-table-column is true. The mouseover action will make the text of this column render as html...