simdjson:fuzz_dump_raw_tape: Use-of-uninitialized-value in std::__1::basic_ostream<char, std::__1::char_traits<char>>& std::__1::__put_char

Detailed Report: https://oss-fuzz.com/testcase?key=6373537834401792 Project: simdjson Fuzzing Engine: libFuzzer Fuzz Target: fuzzdumprawtape Job Type: libfuzzermsansimdjson Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: std::1::basicostream& std::1::putchar...

simdjson:fuzz_element: Use-of-uninitialized-value in element-inl.h

Detailed Report: https://oss-fuzz.com/testcase?key=5320136975515648 Project: simdjson Fuzzing Engine: libFuzzer Fuzz Target: fuzzelement Job Type: libfuzzermsansimdjson Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: element-inl.h Sanitizer: memory MSAN...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

PT-2025-39377

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS version 7 Description A buffer overflow issue exists in MikroTik RouterOS 7. The issue is located in the parse json element function within the libjson.so component, specifically accessible through the /rest/ip/address/print...

GHSA-9MV7-3C64-MMQW xml2rfc is vulnerable to arbitrary file reads through prepped files

Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. References This is related ...

PT-2025-39843

Name of the Vulnerable Software and Affected Versions xml2rfc affected versions not specified Description An issue occurs during the generation of PDF files where an attacker can read arbitrary files from the filesystem. This is achieved by injecting a malicious link element into the prepped...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:element-plus is an A Component Library for Vue 3 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious...

GHSA-5M5X-9J46-H678 Element Plus Link component (el-link) implements insufficient input validation for the href attribute

Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

Improper Encoding or Escaping of Output

Overview element-plus is an A Component Library for Vue 3 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious sites, or conduct...

1997ckf-ui-comp (>=0.0.9, <=0.0.17), 1data-business (>=0.0.1, <=0.0.3) +6247 more potentially affected by CVE-2025-57665 via element-plus (>=1.0.1-beta.0, <=2.14.7)

element-plus NPM version =1.0.1-beta.0, =0.0.9, =0.0.1, =1.0.0, =0.1.11, =0.1.0, =1.0.0, =0.3.1, =1.0.0-beta.0, =1.0.0, =0.0.1-alpha.10, =0.1.6-alpha.17, =0.1.6-alpha.18 - @17mkh/ui 0.0.2 - @1api/serve 0.1.0 and more Source cves: CVE-2025-57665 Source advisory: SNYK:JS-ELEMENTPLUS-12670415...

Element Plus Link component (el-link) implements insufficient input validation for the href attribute

Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

Uncontrolled Search Path Element

Overview Affected versions of this package are vulnerable to Uncontrolled Search Path Element via the DLL loading process. An attacker can execute arbitrary code by placing a malicious DLL in a user-writable directory that is included in the system PATH. Remediation Upgrade LizardByte/Sunshine to...

PT-2025-36908

Name of the Vulnerable Software and Affected Versions: Element Plus versions through 2.10.6 Description: The Element Plus Link component el-link does not sufficiently validate input for the href attribute, creating a security gap. This allows attackers to inject malicious URLs using dangerous...

CVE-2025-57665

The Element Plus UI component library (NPM) is vulnerable to insufficient input validation in the el-link component through version 2.10.6 . The component fails to perform protocol validation, URL sanitization, or security header enforcement on user-controlled href attributes, passing them direct...

The vulnerability of the ub_4159F8() function (/web_cste/cgi-bin/cstecgi.cgi) of the Totolink N600R router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the ub4159F8 function /webcste/cgi-bin/cstecgi.cgi of the Totolink N600R router’s microprogramming software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

Element Plus 安全漏洞

Element Plus is an open source Vue.js 3 UI library from the China Element Plus organization. A security vulnerability exists in Element Plus 2.10.6 and earlier versions, which stems from insufficient input validation of the href attribute and could lead to cross-site scripting attacks and phishin...

CVE-2025-57665: Improper Neutralization of Input During Web Page Generation

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...