Malicious code in px8my (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c972c885927d861e92a964b7ab752e5e91ae2731092a51b08a64fbf97f015cdf The package's main entry px.js is a browser-only script that creates a full-viewport iframe pointing at the hardcoded external URL...

CVE-2026-47068

Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenixstorybook allows cross-session PubSub topic injection via a URL query parameter. 'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handleparams/3 in lib/phoenixstorybook/live/story/componentiframelive.ex read...

CVE-2025-59430

Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically...

Cross-site Scripting (XSS)

Overview @meshconnect/web-link-sdk is an A client-side JS library for integrating with Mesh Connect Affected versions of this package are vulnerable to Cross-site Scripting XSS via the createLink.openLink function. An attacker can execute arbitrary JavaScript code in the context of the parent pag...

CVE-2025-59430 Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink

Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically...

CVE-2025-59430

Mesh Connect JS SDK contains a cross-site scripting (XSS) vulnerability in the web-link component. Prior to version 3.3.2, createLink.openLink does not sanitize the URL protocol, allowing an attacker-controlled base64-encoded payload to set an iframe src that executes arbitrary JavaScript in the ...

PT-2025-39033

Name of the Vulnerable Software and Affected Versions Mesh Connect JS SDK versions prior to 3.3.2 Description Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. A lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrar...