CVE-2024-25865

Cross Site Scripting XSS vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function...

CVE-2024-25865

CVE-2024-25865 describes a Cross-Site Scripting (XSS) vulnerability in hexo-theme-anzhiyu v1.6.12, allowing remote attackers to execute arbitrary code via the algolia search function. The issue is documented across multiple sources (NVD, Red Hat, GHSA, OSV, CNNVD, etc.) with consistent descriptio...

CVE-2024-25865

Cross Site Scripting XSS vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function...

CVE-2024-25865

Cross Site Scripting XSS vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function...

Path Traversal

Hexo is vulnerable to a Path Traversal attack .The vulnerability is due to a flaw in the file read functionality and allows an attacker to exploit this vulnerability by manipulating the file path input thus leading to arbitrary file read...

@dpu/hexo-github-include (>=0.0.1 <=0.0.2), @exabugs/hexo-theme-icarus (=5.1.0) +114 more potentially affected by CVE-2023-39584 via hexo (>=2.4.5 <=7.0.0)

hexo NPM version =2.4.5, =0.0.1, =1.0.0, =1.4.0, =1.0.2, =22.8.141, =1.0.0, =1.0.0, =1.0.11, =1.0.16, =1.0.17 - diangua-test-hexo-site =0.0.0 and more Source cves: CVE-2023-39584 Source advisory: OSV:GHSA-X2JC-989C-47Q4...

GHSA-X2JC-989C-47Q4 Hexo `include_code` has a path traversal

Hexo up to v7.1.1 was discovered to contain an arbitrary file read vulnerability...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

Design/Logic Flaw

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

PT-2023-27030 · Hexo · Hexo

Name of the Vulnerable Software and Affected Versions: Hexo versions up to 7.0.0 RC2 Description: Hexo was discovered to contain an arbitrary file read issue. This allows for the reading of arbitrary files, potentially leading to sensitive information disclosure. Recommendations: For versions up ...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

CVE-2023-39584

Hexo up to v7.0.0 RC2 was discovered to contain an arbitrary file read vulnerability...

Hexo Security Vulnerability

Hexo is a fast, simple and powerful blogging framework by Tommy Chen, an individual developer in China. A security vulnerability exists in Hexo v7.0.0 RC2 and earlier versions, which stems from an arbitrary file read vulnerability...

CVE-2023-39584

CVE-2023-39584 (Hexo) affects Hexo up to 7.0.0 RC2. The issue is an arbitrary file read caused by a flawed file read/path handling in the include_code functionality, enabling reading arbitrary files. Impact is potential sensitive data disclosure. Remediation: upgrade to a version later than 7.0.0...

MAL-2023-498 Malicious code in hexo-static (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 786a3c76792f8d106d7c90d5f095e80767120d5f4efcac07267d9e71ad3d9b4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hexo-static (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 786a3c76792f8d106d7c90d5f095e80767120d5f4efcac07267d9e71ad3d9b4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

hexo-wustxiao-blog (=1.1.1) potentially affected by CVE-2019-17606 via hexo-admin (=2.3.0)

hexo-admin NPM version =2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on hexo-admin and may be impacted: - hexo-wustxiao-blog =1.1.1 Source cves: CVE-2019-17606 Source advisory: OSV:GHSA-G784-Q3P3-26RM...

GHSA-G784-Q3P3-26RM hexo-admin plugin for Node.js XSS Vulnerability

The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post...