277 matches found
CVE-2025-13308
The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rejecturl' parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes ...
PT-2025-49339
The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject url' parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes...
CVE-2025-58747 Dify MCP OAuth Flow Vulnerable to XSS
Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow implementation where the authorizationurl...
CVE-2025-58747
CVE-2025-58747 affects Dify up to version 1.9.1, where the MCP OAuth flow passes the remote server’s authorization_url directly to window.open without validation, enabling arbitrary JavaScript execution (XSS) when a victim connects to a malicious MCP server. Affected component: MCP OAuth in Dify....
EUVD-2006-2966
Malware in sbrugna...
EUVD-2007-0777
Malware in sbrugna...
EUVD-2010-1612
Malware in sbrugna...
EUVD-2009-1593
Malware in sbrugna...
EUVD-2009-1592
Malware in sbrugna...
EUVD-2006-3755
Malware in sbrugna...
EUVD-2009-3002
Malware in sbrugna...
EUVD-2021-1166
Malware in sbrugna...
EUVD-2017-1561
Malware in sbrugna...
EUVD-2006-0476
Malware in sbrugna...
EUVD-2009-3000
Malware in sbrugna...
EUVD-2006-0539
Malware in sbrugna...
EUVD-2006-0241
Malware in sbrugna...
EUVD-2024-16398
Malicious code in bioql PyPI...