73142 matches found
javascript-deobfuscator
javascript-deobfuscator أداة إزالة التشويش لمخرجات javascript-obfuscator 5.x. أعطها JavaScript مشوّشًا، واحصل على JavaScript مقروء يعمل بنفس الطريقة. الإعداد يتطلب Node 18+. git clone https://github.com/lolcaken/javascript-deobfuscator.git cd javascript-deobfuscator npm install npm run build...
PT-2026-107505
Name of the Vulnerable Software and Affected Versions SMA1000 affected versions not specified Description A post-authentication Stored Cross-Site Scripting XSS issue exists in the Appliance Management Console AMC. This allows a remote authenticated attacker with administrator privileges to store...
CVE-2025-70519
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...
EUVD-2025-211048
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...
MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195
This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. Notice: This release updates CDN URLs where...
CVE-2025-70515
The Fanvil x7a device, running firmware version 2.6.0.1182 , is vulnerable to a cross-site scripting (XSS) flaw in its device log component . The root cause is the failure to properly sanitize or encode reflected user-supplied data, allowing an attacker to inject HTML and execute malicious JavaSc...
EUVD-2025-211052
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...
CVE-2025-70515
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...
CVE-2025-70519
The device log component of Fanvil x7a firmware version 2.6.0.1182 is vulnerable to a cross-site scripting (XSS) flaw. The software fails to properly sanitize or encode reflected user-supplied data , allowing an attacker to inject HTML and execute malicious JavaScript on any browser rendering the...
PT-2026-107526
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...
PT-2026-107522
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...
CVE-2026-106374
A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/552832446...
CVE-2026-96594 Gitea repository media API stored XSS
The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...
CVE-2026-96594 Gitea repository media API stored XSS
The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...
CVE-2026-96594 Gitea repository media API stored XSS
The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...
EUVD-2026-94066
The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...
CVE-2026-106550 CVE-2026-106550
Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...
CVE-2026-106550 CVE-2026-106550
Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...
CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...