CVE-2025-59052

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as ...

CVE-2025-59052 Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as ...

CVE-2025-59052 Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as ...

CVE-2025-59052

CVE-2025-59052: Angular SSR race condition in the platform injector can cause cross-request data leaks due to a global injector state shared across concurrent SSR requests. Affected: Angular SSR/server rendering path using bootstrapApplication, getPlatform, or destroyPlatform. Patched in all acti...

CVE-2025-59052 Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container the "platform injector" to hold request-specific state during server-side rendering. For historical reasons, the container was stored as ...

PT-2025-37099

Name of the Vulnerable Software and Affected Versions: Angular versions 18.2.14 through 18.2.21 Angular versions 19.2.15 through 19.2.16 Angular versions 20.3.0 Angular versions 21.0.0-next.3 Description: Angular uses a DI container to hold request-specific state during server-side rendering. Due...

Malicious code in ams-iframe-injector (npm)

The package ams-iframe-injector was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-14465 Malicious code in ams-iframe-injector (npm)

The package ams-iframe-injector was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Exploit for CVE-2025-24203

iDevice? A major vulnerability discovered by Ian Beer based o...

CVE-2024-10320

The Cookielay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookielay shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2022-47141

Cross-Site Request Forgery CSRF vulnerability in Seerox WP Dynamic Keywords Injector plugin = 2.3.15 versions...

CVE-2024-32528

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Seerox WP Dynamic Keywords Injector allows Reflected XSS.This issue affects WP Dynamic Keywords Injector: from n/a through 2.3.18...

GHSA-RPMJ-RPGJ-QMPM vulnerabilities

Vulnerabilities for packages: nushell, sdp-k8s-injector, berg, linkerd-extension-init, lychee, linkerd2, zed, rustup, sccache...

CVE-2025-23483

Cross-Site Request Forgery CSRF vulnerability in hoyce Universal Analytics Injector universal-analytics-injector allows Stored XSS.This issue affects Universal Analytics Injector: from n/a through = 1.0.3...

CVE-2025-23483

CVE-2025-23483 — The connected Red Hat/ENISA records confirm a Cross-Site Request Forgery (CSRF) vulnerability in Niklas Olsson’s Universal Analytics Injector plugin that enables Stored XSS. Affected: Universal Analytics Injector versions from 0? through 1.0.3 (per description: “from n/a through ...

CVE-2025-23483 WordPress Universal Analytics Injector plugin <= 1.0.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in hoyce Universal Analytics Injector universal-analytics-injector allows Stored XSS.This issue affects Universal Analytics Injector: from n/a through = 1.0.3...

CVE-2025-23483 WordPress Universal Analytics Injector plugin <= 1.0.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Niklas Olsson Universal Analytics Injector allows Stored XSS.This issue affects Universal Analytics Injector: from n/a through 1.0.3...

WordPress Universal Analytics Injector plugin <= 1.0.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Universal Analytics Injector versions = 1.0.3...

PT-2025-4900 · Niklas Olsson · Universal Analytics Injector

Name of the Vulnerable Software and Affected Versions: Niklas Olsson Universal Analytics Injector versions 1.0.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can perform actions on behalf of a user without the...

WordPress plugin Universal Analytics Injector 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...