CVE-2025-70519

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2025-70515

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2026-102258

Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...

CVE-2026-102258

Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...

CVE-2026-102258

Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...

CVE-2026-102258

A post-authentication Stored Cross-Site Scripting (XSS) vulnerability exists in the SonicWall SMA1000 appliance's Management Console (AMC) . Under specific conditions, a remote authenticated attacker with administrator privileges can store and execute arbitrary JavaScript code within the AMC. Thi...

EUVD-2026-94224

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS CWE-79. Users are recommended to upgrade to version 4.5.3...

100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

The Computer Emergency Response Team of Ukraine CERT-UA has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer aka Psychedelic Stealer. The activity, which was observed by the agency in...

CVE-2025-70515

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2025-70519

The device log component of Fanvil x7a firmware version 2.6.0.1182 is vulnerable to a cross-site scripting (XSS) flaw. The software fails to properly sanitize or encode reflected user-supplied data , allowing an attacker to inject HTML and execute malicious JavaScript on any browser rendering the...

EUVD-2025-211048

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

PT-2026-107526

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

PT-2026-107522

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2025-70515

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

EUVD-2025-211052

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2025-70515: Improper Neutralization of Input During Web Page Generation

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. Notice: This release updates CDN URLs where...

CVE-2025-70519

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2025-70515

The Fanvil x7a device, running firmware version 2.6.0.1182 , is vulnerable to a Cross-Site Scripting (XSS) flaw in its device log component . The root cause is the failure to properly sanitize or encode reflected user-supplied data, which allows an attacker to inject HTML and execute malicious Ja...

When Flaws Cascade: Understanding Vulnerabilities and Exploitation Chains in JavaScript Engines

JavaScript engines are pivotal to modern web browsers, enabling the execution of dynamic and interactive web applications. However, their complexity and widespread adoption make them prime targets for attackers exploiting vulnerabilities. While existing research has focused on detecting...