CVE-2025-62295

SOPlanning is vulnerable to Stored XSS in /groupeform endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...

CVE-2025-62297

CVE-2025-62297 (SOPlanning) is a stored XSS vulnerability affecting the SOPlanning application. Multiple endpoints are reported where an attacker with medium privileges can inject arbitrary HTML/JS that is rendered when editors load pages, including /projets, /taches, /status, /groupe_form, and r...

EUVD-2025-198264

phppgadmin vulnerable to Cross-site Scripting...

firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript: WebAssembly component...

CVE-2025-63693

The comment editing template dzz/comment/template/editform.htm in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and...

firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript: WebAssembly component...

Malicious code in postcss-loader-prosthetics-loopback-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f9f63b6e2e1816f62d699a65d1f5b8c88dc6d76c09ded78c5dca4dcc42d958 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188783 Malicious code in postcss-loader-prosthetics-loopback-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f9f63b6e2e1816f62d699a65d1f5b8c88dc6d76c09ded78c5dca4dcc42d958 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-177557

Malicious code in nodejs-csrf-sagitta-materialize npm...

EUVD-2025-178631

Malicious code in gulp-javascript-carpo-markdown-pdf npm...

EUVD-2025-178286

Malicious code in javascript-async-enceladus-eslint-plugin npm...

EUVD-2025-178285

Malicious code in javascript-css-minimizer-webpack-plugin-geochronology-foundation npm...

EUVD-2025-180424

Malicious code in antares-cluster-ursa-javascript npm...

firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript: WebAssembly component...

firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript: WebAssembly component...

EUVD-2025-112236

Malicious code in javascript-chai-levels-meissa npm...

EUVD-2025-112235

Malicious code in javascript-dotenv-quasar-spica npm...

EUVD-2025-112228

Malicious code in javascript-pegasus-chariklo-standard npm...

EUVD-2025-112225

Malicious code in javascript-procyon-nconf-odin npm...

EUVD-2025-112223

Malicious code in javascript-scorpius-global-framework npm...