7017 matches found
JoomSky Joomla! Component Js Jobs 跨站请求伪造漏洞
JoomSky Joomla! Component Js Jobs is a human resources component developed by JoomSky Corporation, designed for publishing job listings, managing positions, and facilitating job applications on Joomla websites. Version 1.2.0 of JoomSky Joomla! Component Js Jobs contains a cross-site request...
CVE-2018-25327: Cross-Site Request Forgery (CSRF)
Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token validation. Attackers can craft malicious HTML forms targeting administrative endpoints like job.jobenforcedelete to delete job entries or modi...
Exploit for Server-Side Request Forgery in Vercel Next.Js
CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Pre-authentic...
CVE-2026-24118
A flaw was found in vm2, an open-source sandbox for Node.js. This sandbox breakout vulnerability allows attackers to write malicious code that can escape the vm2 sandbox. Successful exploitation enables the execution of arbitrary commands on the host system, leading to critical system compromise...
CVE-2026-8336
After invoking $internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine through $where, $function, mapreduce reduce stage, etc. is used also in...
SECpocs
Next.js React Server Components RCE Exploit Exploits CVE-2025...
Exploit for Server-Side Request Forgery in Vercel Next.Js
╔═══════════════════════════════════════════════════════════...
CVE-2026-38728
An issue in Nodemailer smtpserver before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream.write, lib/smtp-stream.js components...
Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-094eb13bb1)
The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-094eb13bb1 advisory. nginx-mod-fancyindex: - Rebuild for 1.30.1 nginx-mod-headers-more: - Rebuild for 1.30.1 nginx-mod-naxsi: - Rebuild for 1.30.1 nginx-mod-js-challenge...
Siemens Teamcenter PDF.js Arbitrary Code Execution (SSA-827383)
The version of Siemens Teamcenter installed on the remote host is affected by a vulnerability: - A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. CVE-2024-4367 Note that Nessus has not tested for this issue but has...
CVE-2026-44670
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View AV / database names without any HTML escape, then a render template uses raw strings.ReplaceAlltpl, "$avName", nodeAvName to embed the name in HTML before pushing to all clients via...
Cross-site Scripting (XSS)
Overview ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the fides.js script's override mechanism for the banner description field when HTML-formatted descriptions are enabled. An attacker can...
CVE-2026-44482
CVE-2026-44482 affects the SoundCloud Client app (soundcloud-rpc) built on Electron. Before 0.1.8, a track title could contain an HTML payload that, via the preload API window.soundcloudAPI.sendTrackUpdate and IPC to the Electron main process, is rendered as raw HTML in privileged views with Node...
WS-2019-0477
Slush-fullstack-framework v0.9.2 contains malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...
WS-2019-0456
Ng-ui-library v1.0.987 contains malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...
WS-2019-0457
Ngx-context-menu v0.0.26 contains malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...
WS-2019-0437
All versions of js-base64-int contains malicious code. The package uploaded system information such as OS and hostname to a remote server...
WS-2019-0438
All versions of js-regular contains malicious code. The package uploaded system information such as OS and hostname to a remote server...
WS-2019-0432
Grunt-radical, version 0.0.14 contains malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...