PT-2025-45527

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.34 and below Description Open WebUI, a self-hosted artificial intelligence platform designed for offline operation, contains a Stored DOM XSS issue. When the 'Insert Prompt as Rich Text' functionality is enabled, the...

CVE-2025-63785

CVE-2025-63785 affects the Onlook web application (version 0.2.32) in its text editor feature. The root cause is unsafe handling of user input: input is not sanitized before being injected into the DOM via innerHTML when editing a text element, enabling a DOM-based XSS attack. Exploitation would ...

GHSA-G955-VW6W-V6PP Citizen vulnerable to stored XSS in sticky header button messages

Summary The JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages. Details In the copyButtonAttributes function in stickyHeader.js, when copying the button labels, the innerHTML of the new...

CVE-2025-62508 Citizen vulnerable to stored XSS in sticky header button messages

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s...

EUVD-2010-1256

Malware in sbrugna...

EUVD-2012-2570

Malware in sbrugna...

EUVD-2020-0615

Malware in sbrugna...

EUVD-2025-27502

Malicious code in bioql PyPI...

EUVD-2025-15174

Malicious code in bioql PyPI...

EUVD-2025-29217

Malicious code in bioql PyPI...

EUVD-2024-54618

Malicious code in bioql PyPI...

EUVD-2025-28574

Malicious code in bioql PyPI...

EUVD-2024-26188

Malicious code in bioql PyPI...

CVE-2025-60249

CVE-2025-60249 affects vulnerability-lookup 2.16.0 and enables XSS via Bundles, Comments, and Sightings components (bundle.py, comment.py, user.py). The root cause is unsafe handling of user-supplied input, with untrusted data rendered in templates/tables due to innerHTML usage and insufficient v...

PT-2025-39430

Name of the Vulnerable Software and Affected Versions vulnerability-lookup version 2.16.0 Description A cross-site scripting XSS issue exists in the handling of user-supplied input within the Bundles, Comments, and Sightings components of the software. Untrusted data was not properly sanitized...

Cross-site Scripting (XSS)

Overview @lobehub/chat is a Lobe Chat - an open-source, high-performance chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application. Affected versions of this package are...

PT-2025-38409

Name of the Vulnerable Software and Affected Versions Lobe Chat versions prior to 1.129.4 Description Lobe Chat, an open-source artificial intelligence chat framework, contains a cross-site scripting XSS issue in how it handles chat messages. Specifically, when a server response includes a...

CVE-2025-58172

drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting XSS vulnerability exists in the debug logging functionality. User controlled content is inserted directly into the DOM via innerHTML without sanitization when the global function...

CVE-2025-58172

The CVE-2025-58172 issue affects drawnix versions through 0.2.1, where the debug logging logger inserts untrusted content directly into the DOM via innerHTML without sanitization (in apps/web/src/app/app.tsx). The root cause is unsanitized user-controlled data being written to the DOM through the...

CVE-2025-58172 drawnix debug logging cross-site scripting vulnerability

drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting XSS vulnerability exists in the debug logging functionality. User controlled content is inserted directly into the DOM via innerHTML without sanitization when the global function...