@agniflow-ui/panda-preset (0.0.4), @agniflow-ui/react (>=0.0.1, <=0.0.4) +347 more potentially affected by CVE-2024-57079 via @zag-js/core (>=0.0.0-dev-20220406144843, <=0.82.1)

@zag-js/core NPM version =0.0.0-dev-20220406144843, =0.0.1, =0.0.1, =0.0.3-02402d7.0, =0.0.28-86b217d.0, =0.1.0, =0.0.0-rc-20221106094212, =0.0.0-rc-20221106094212, =0.1.0, =0.0.0-rc-20221106094212, =0.0.17, =0.0.2, =0.0.10 - @atlrdsgn/kit 0.3.7 - @beae-ui/accordion 1.0.0 - @beae-ui/pin-input 1.0...

@zag-js/core prototype pollution

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2022-47151

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...

CVE-2024-57079

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2022-46838

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...

CVE-2022-46839

Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...

CVE-2017-11429

Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to...

CVE-2024-7094

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which...

CVE-2024-49678

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Jinwen js allows Reflected XSS.This issue affects js paper: from n/a through 2.5.7...

CVE-2024-57079

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

@agniflow-ui/panda-preset (0.0.4), @agniflow-ui/react (>=0.0.1, <=0.0.4) +347 more potentially affected by CVE-2024-57079 via @zag-js/core (>=0.0.0-v1-beta-20250220125322, <=0.82.1)

@zag-js/core NPM version =0.0.0-v1-beta-20250220125322, =0.0.1, =0.0.1, =0.0.3-02402d7.0, =0.0.28-86b217d.0, =0.1.0, =0.0.0-rc-20221106094212, =0.0.0-rc-20221106094212, =0.1.0, =0.0.0-rc-20221106094212, =0.0.17, =0.0.2, =0.0.10 - @atlrdsgn/kit 0.3.7 - @beae-ui/accordion 1.0.0 - @beae-ui/pin-input...

CVE-2024-57079

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57079

The @zag-js/core library, specifically version v0.50.0 , is vulnerable to prototype pollution within the lib.deepMerge function. This flaw allows an attacker to cause a Denial of Service (DoS) by supplying a crafted payload. Numerous downstream packages, such as @ark-ui/react , @ark-ui/vue , and ...

CVE-2024-57079: Uncontrolled Resource Consumption

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57079

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2025-22206

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers administrator to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature...

CVE-2025-22206 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.2 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers administrator to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature...

CVE-2025-22206

The JS Jobs plugin for Joomla (versions 1.1.5-1.4.2 ) contains a SQL injection vulnerability (CWE-89). Authenticated attackers with administrator privileges can execute arbitrary SQL commands by targeting the 'fieldfor' parameter within the GDPR Field feature . To mitigate this risk, it is recomm...

CVE-2024-13607

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possible for authenticat...

CVE-2024-13607 JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possible for authenticat...