EUVD-2019-6571

Malware in sbrugna...

EUVD-2010-0671

Malware in sbrugna...

EUVD-2018-10559

Malware in sbrugna...

EUVD-2018-0300

Malware in sbrugna...

GHSA-7R4H-VMJ9-WG42 Flowise Stored XSS vulnerability through logs in chatbot

Description In the chat log, tags like input and form are allowed. This makes a potential vulnerability where an attacker could inject malicious HTML into the log via prompts. When an admin views the log containing the malicious HTML, the attacker could steal the admin's credentials or sensitive...

EUVD-2024-32419

Malicious code in bioql PyPI...

EUVD-2023-58396

Malicious code in bioql PyPI...

EUVD-2024-37373

Malicious code in bioql PyPI...

EUVD-2023-24367

Malicious code in bioql PyPI...

EUVD-2025-7040

Malicious code in bioql PyPI...

EUVD-2023-26452

Malicious code in bioql PyPI...

EUVD-2024-0652

Malicious code in bioql PyPI...

EUVD-2024-20404

Malicious code in bioql PyPI...

EUVD-2022-0876

Malicious code in bioql PyPI...

Stored Cross-site Scripting (XSS)

formcms is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper validation of uploaded avatar files, which allows an attacker to upload malicious .html files containing JavaScript that execute in a privileged user’s browser when accessed via a public URL...

CVE-2025-56710

A Cross-Site Request Forgery CSRF vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. This flaw allows an attacker to trick authenticated users into unintentionally modifying their account details. By crafting a malicious HTML page, ...

CVE-2025-59053

AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...

CVE-2025-50733

NextChat has an XSS vulnerability in the HTMLPreview component (artifacts.tsx). User-influenced HTML from AI responses is rendered in an iframe with allow-scripts without proper sanitization, enabling injection of JavaScript. Impact stated includes exfiltration of sensitive data (e.g., API keys i...

Cross-site Scripting (XSS)

Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the calculateMathMLDimensions function, which was introduced in 5c69e5f. An attacker can execute...

CVE-2025-51488

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.4, allowing remote attackers to store and execute arbitrary JavaScript by including a malicious HTML payload in the Name parameter when creating a new Admin...